@uipath/platform-tool@1.202.1
Manage UiPath platform-level resources such as tenant licensing.
AI Security Review
scanned 28d ago · by lpm-firewall-aiStatic inspection shows a UiPath licensing CLI whose network and process use is limited to user-run commands, https authority auth, and a local browser opener. There is no install lifecycle, self-dependency, or hidden exfiltration sink.
Decision evidence
public snapshot- package.json exposes a module entry and the platform-tool bin and declares no install lifecycle scripts.
- Login uses a caller-configured https authority, defaulting to cloud.uipath.com, and posts refresh tokens only to that host's identity token endpoint.
- The bundled opener spawns a local browser command such as xdg-open when the CLI opens a URL.
- Windows registry access is a fixed reg query for a UiPath analytics id, and commander spawn only launches declared subcommand executables.
Source & flagged code
5 flagged · loading sourceSource decodes a Base64-obscured HTTP endpoint at runtime.
dist/tool-03f4ek8a.jsView on unpkg · L30970Login uses a caller-configured https authority, defaulting to cloud.uipath.com, and posts refresh tokens only to that host's identity token endpoint.
dist/tool-03f4ek8a.jsView on unpkg · L27410Login uses a caller-configured https authority, defaulting to cloud.uipath.com, and posts refresh tokens only to that host's identity token endpoint.
dist/tool-03f4ek8a.jsView on unpkg · L27507Findings
Affected versions and remediation
This report applies to @uipath/platform-tool@1.202.1.
See all versions of @uipath/platform-tool for other recorded verdicts.
- Review the evidence and your use of @uipath/platform-tool@1.202.1 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.