@uipath/platform-tool@1.199.0: Clean npm security report (Allow) | LPM Firewall

Loading npm security reports…

@uipath/platform-tool@1.199.0: Clean npm security report (Allow) | LPM Firewall

Source & flagged code

6 flagged · loading source

dist/index.jsView file

756var EventEmitter = __require("node:events").EventEmitter; L757: var childProcess = __require("node:child_process"); L758: var path = __require("node:path");

High

Child Process

Package source references child process execution.

dist/index.jsView on unpkg · L756

38Cross-file remote execution chain: dist/index.js spawns dist/tool.js; helper contains network access plus dynamic code execution. L38: class CommanderError extends Error { L39: constructor(exitCode, code, message) { L40: super(message); ... L756: var EventEmitter = __require("node:events").EventEmitter; L757: var childProcess = __require("node:child_process"); L758: var path = __require("node:path"); ... L802: this._outputConfiguration = { L803: writeOut: (str) => process2.stdout.write(str), L804: writeErr: (str) => process2.stderr.write(str),

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/index.jsView on unpkg · L38

dist/tool.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @uipath/platform-tool@1.196.0 matchedIdentity = npm:QHVpcGF0aC9wbGF0Zm9ybS10b29s:1.196.0 similarity = 1.000 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/tool.jsView on unpkg

149L150: // ../../node_modules/powershell-utils/index.js L151: import process3 from "node:process";

High

Shell

Package source references shell execution.

dist/tool.jsView on unpkg · L149

•Manifest-reachable source resolves another installed package, overwrites its runtime code, and injects package-defined remote behavior. dist/tool.js: var UIPATH_HOME_DIR = ".uipath", AUTH_FILENAME = ".auth", DEFAULT_BASE_URL = "https://cloud.uipath.com", DEFAULT_AUTH_TIMEOUT_MS; // ../../node_modules/is-inside-container/node_modules/is-docker/index.js // ../../node_modules/is-inside-container/index.js // ../../node_modules/wsl-utils/node_modules/is-wsl/index.js // ../../node_modules/powershell-utils/index.js // ../../node_modules/wsl-utils/utilities.js // ../../node_modules/wsl-utils/index.js // ../../node_modules/open/node_modules/define-lazy-prop/index.js

High

Entrypoint Foreign Package Code Overwrite

Manifest-reachable source overwrites another installed package with package-defined remote behavior.

dist/tool.jsView on unpkg

54116var telemetryInstanceSlot = singleton("TelemetryService"); L54117: var DEFAULT_AI_CONNECTION_STRING = atob("[redacted]... L54118: function getGlobalTelemetryInstance() {

High

Base64 Obscured Url

Source decodes a Base64-obscured HTTP endpoint at runtime.

dist/tool.jsView on unpkg · L54116

Source & flagged code

6 flagged

dist/index.jsView file

Lines 18-58javascript

18 if (cached)

19 return cached;

20 }

21 target = mod != null ? __create(__getProtoOf(mod)) : {};

22 const to = isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target;

23 for (let key of __getOwnPropNames(mod))

24 if (!__hasOwnProp.call(to, key))

25 __defProp(to, key, {

26 get: __accessProp.bind(mod, key),

27 enumerable: true

28 });

29 if (canCache)

30 cache.set(mod, to);

31 return to;

32};

33var __commonJS = (cb, mod) => () => (mod || cb((mod = { exports: {} }).exports, mod), mod.exports);

34var __require = /* @__PURE__ */ createRequire(import.meta.url);

35

36// ../../node_modules/commander/lib/error.js

37var require_error = __commonJS((exports) => {

38 class CommanderError extends Error {

39 constructor(exitCode, code, message) {

40 super(message);

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/index.jsView on unpkg · L38

41 Error.captureStackTrace(this, this.constructor);

42 this.name = this.constructor.name;

43 this.code = code;

44 this.exitCode = exitCode;

45 this.nestedError = undefined;

46 }

47 }

48

49 class InvalidArgumentError extends CommanderError {

50 constructor(message) {

51 super(1, "commander.invalidArgument", message);

52 Error.captureStackTrace(this, this.constructor);

53 this.name = this.constructor.name;

54 }

55 }

56 exports.CommanderError = CommanderError;

57 exports.InvalidArgumentError = InvalidArgumentError;

58});

Lines 736-776javascript

736 });

737 similar.sort((a, b) => a.localeCompare(b));

738 if (searchingOptions) {

739 similar = similar.map((candidate) => `--${candidate}`);

dist/tool.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @uipath/platform-tool@1.196.0 matchedIdentity = npm:QHVpcGF0aC9wbGF0Zm9ybS10b29s:1.196.0 similarity = 1.000 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/tool.jsView on unpkg

149L150: // ../../node_modules/powershell-utils/index.js L151: import process3 from "node:process";

High

Shell

Package source references shell execution.

dist/tool.jsView on unpkg · L149

•Manifest-reachable source resolves another installed package, overwrites its runtime code, and injects package-defined remote behavior. dist/tool.js: var UIPATH_HOME_DIR = ".uipath", AUTH_FILENAME = ".auth", DEFAULT_BASE_URL = "https://cloud.uipath.com", DEFAULT_AUTH_TIMEOUT_MS; // ../../node_modules/is-inside-container/node_modules/is-docker/index.js // ../../node_modules/is-inside-container/index.js // ../../node_modules/wsl-utils/node_modules/is-wsl/index.js // ../../node_modules/powershell-utils/index.js // ../../node_modules/wsl-utils/utilities.js // ../../node_modules/wsl-utils/index.js // ../../node_modules/open/node_modules/define-lazy-prop/index.js

High

Entrypoint Foreign Package Code Overwrite

Manifest-reachable source overwrites another installed package with package-defined remote behavior.

dist/tool.jsView on unpkg