registry / @uipath/platform-tool / 1.202.0
@uipath/platform-tool@1.202.0
Manage UiPath platform-level resources such as tenant licensing.
AI Security Review
scanned 28d ago · by lpm-firewall-aiStatic inspection shows a first-party UiPath CLI with no lifecycle scripts, no self-install chain, and network use limited to the configured UiPath identity host. Child-process calls are local registry and WSL browser helpers activated by the CLI, not an install-time attack.
Static reason
One or more suspicious static signals were detected.
Trigger
A user runs the platform-tool binary or imports the module and calls registerCommands.
Impact
No confirmed unauthorized code execution, credential theft, persistence, or foreign control-surface mutation.
Mechanism
The CLI registers platform resource commands and, when authenticating, posts tokens only to the configured UiPath identity endpoint. PowerShell is limited to a fixed default-browser registry query.
AI rationale
Static inspection shows a first-party UiPath CLI with no lifecycle scripts, no self-install chain, and network use limited to the configured UiPath identity host. Child-process calls are local registry and WSL browser helpers activated by the CLI, not an install-time attack.
Network endpoints2
cloud.uipath.comregistry.npmjs.org/
Decision evidence
public snapshotAI called this Clean at 86.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- package.json has no install lifecycle scripts; the bin entry platform-tool points at dist/index.js, which builds a Commander program and parses process.argv.
- dist/tool-rvy9ye18.js registers only UiPath tenant, user, usage, top-up, group, license, and consumable commands when the CLI runs.
- Bundled PowerShell use in dist/index-sby22td6.js is a fixed HKCU URL-association query used to detect the default browser under WSL, not an arbitrary command from the network.
- OAuth refresh posts the refresh token to ${baseUrl}/identity_/connect/token on the configured UiPath authority.
Evidence against
- child_process and fetch are present, but both are tied to the user-invoked CLI: Windows registry reads, WSL path and browser helpers, and the configured identity token endpoint.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell
HighEntropyStrings
Source & flagged code
5 flagged · loading sourcedist/tool-rvy9ye18.jsView file
30970var telemetryInstanceSlot = singleton("TelemetryService");
L30971: var DEFAULT_AI_CONNECTION_STRING = atob("[redacted]...
L30972: function getGlobalTelemetryInstance() {
High
Base64 Obscured Url
Source decodes a Base64-obscured HTTP endpoint at runtime.
dist/tool-rvy9ye18.jsView on unpkg · L3097036390name: "platform-tool",
version: package_default.version,
description: "Manage UiPath platform-level resources such as tenant licensing.",
commandPrefix: "platform"
};
var r
Low
Ai Review Evidence
dist/tool-rvy9ye18.js registers only UiPath tenant, user, usage, top-up, group, license, and consumable commands when the CLI runs.
dist/tool-rvy9ye18.jsView on unpkg · L36390dist/index-sby22td6.jsView file
•stage = ast_semantic_analysis; reason = ast_alias_growth_limit_exceeded; limitedFiles = 1
High
Findings
2 High2 Medium8 Low
HighBase64 Obscured Urldist/tool-rvy9ye18.js
HighSemantic Analysis Limiteddist/index-sby22td6.js
MediumNetwork
MediumEnvironment Vars
LowFilesystem
LowHigh Entropy Strings
LowTelemetry
LowUrl Strings
LowNo License
LowSuspicious Lifecycle Evidencepackage.json
LowSuspicious Lifecycle Evidencedist/index.js
LowAi Review Evidencedist/tool-rvy9ye18.js
Affected versions and remediation
This report applies to @uipath/platform-tool@1.202.0.
See all versions of @uipath/platform-tool for other recorded verdicts.
- Review the evidence and your use of @uipath/platform-tool@1.202.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.