registry / @uipath/project-packager / 1.200.0

@uipath/project-packager@1.200.0

UiPath Project Packager - core library for packing individual UiPath projects

AI Security Review

scanned 28d ago · by lpm-firewall-ai

Static inspection found no lifecycle hooks or concrete malicious behavior. Network and process operations are tied to explicit library functions and supplied inputs.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Trigger

Consumer code must invoke an exported method with its own options.

Impact

No confirmed unauthorized execution, persistence, credential harvesting, or exfiltration was identified.

Mechanism

Optional operations use caller-provided package paths and connection configuration; no install-time execution was found.

AI rationale

Static inspection found no lifecycle hooks or concrete malicious behavior. Network and process operations are tied to explicit library functions and supplied inputs.

Decision evidence

public snapshot

AI called this Clean at 92.0% confidence as Benign with low false-positive risk.

Evidence for AI clean decision

The manifest declares library entrypoints and contains no lifecycle script hooks.
The node bundle exposes asynchronous package-signing methods rather than executing signing at import time.
Governance-policy retrieval is gated on an AutomationOps option and supplied connection information.

Evidence against

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsEvalFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 3 file(s), 2.70 MB of source, external domains: github.com, npm.pkg.github.com

Source & flagged code

6 flagged

dist/node.jsView file

Lines 1271-1311javascript

1271I18nManager.registerTranslations("ja", ja_default);

1272I18nManager.registerTranslations("ko", ko_default);

1273I18nManager.registerTranslations("pt", pt_default);

1274I18nManager.registerTranslations("pt-BR", pt_BR_default);

1275I18nManager.registerTranslations("ro", ro_default);

1276I18nManager.registerTranslations("ru", ru_default);

1277I18nManager.registerTranslations("tr", tr_default);

1278I18nManager.registerTranslations("zh-CN", zh_CN_default);

1279I18nManager.registerTranslations("zh-TW", zh_TW_default);

1280I18nManager.registerTranslations("zu", zu_default);

1281

1282// ../../common/dist/index.js

1283import { createRequire } from "node:module";

1284import { randomUUID } from "node:crypto";

1285import { existsSync } from "node:fs";

1286import * as fs6 from "node:fs/promises";

1287import * as os2 from "node:os";

1288import * as path2 from "node:path";

1289import process8 from "node:process";

1290import path from "node:path";

1291import { fileURLToPath } from "node:url";

1292import childProcess3 from "node:child_process";

1293import fs5, { constants as fsConstants2 } from "node:fs/promises";

High

Child Process

Package source references child process execution.

dist/node.jsView on unpkg · L1291

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/node.jsView on unpkg · L1291

1294import { promisify as promisify2 } from "node:util";

1295import childProcess2 from "node:child_process";

1296import fs4, { constants as fsConstants } from "node:fs/promises";

1297import process2 from "node:process";

1298import os from "node:os";

1299import fs3 from "node:fs";

1300import fs2 from "node:fs";

1301import fs from "node:fs";

1302import process3 from "node:process";

1303import { Buffer as Buffer2 } from "node:buffer";

1304import { promisify } from "node:util";

1305import childProcess from "node:child_process";

1306import { promisify as promisify6 } from "node:util";

1307import process6 from "node:process";

1308import { execFile as execFile6 } from "node:child_process";

1309import { promisify as promisify3 } from "node:util";

1310import process4 from "node:process";

1311import { execFile as execFile3 } from "node:child_process";

Lines 2502-2542javascript

2502 getOptionValueSource(key) {

2503 return this._optionValueSources[key];

2504 }

2505 getOptionValueSourceWithGlobals(key) {

2506 let source;

2507 this._getCommandAndAncestors().forEach((cmd)

Lines 10398-10438javascript

10398 } : {}

10399 };

10400 return enriched;

10401 }

10402 generateId() {

10403 const bytes = new Uint8Array(8);

10404

•matchType = previous_version_dangerous_delta matchedPackage = @uipath/project-packager@1.201.0 matchedIdentity = npm:[redacted]:1.201.0 similarity = 0.833 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/node.jsView on unpkg

package.jsonView file

Lines 1-26json

2 "name": "@uipath/project-packager",

3 "license": "MIT",

4 "version": "1.200.0",

5 "description": "UiPath Project Packager - core library for packing individual UiPath projects",

Source & flagged code

6 flagged · loading source

dist/node.jsView file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/node.jsView on unpkg

1291import { fileURLToPath } from "node:url"; L1292: import childProcess3 from "node:child_process"; L1293: import fs5, { constants as fsConstants2 } from "node:fs/promises";

High

Child Process

Package source references child process execution.

dist/node.jsView on unpkg · L1291

2522} L2523: const execArgv = process9.execArgv ?? []; L2524: if (execArgv.includes("-e") || execArgv.includes("--eval") || execArgv.includes("-p") || execArgv.includes("--print")) {

High

Shell

Package source references shell execution.

dist/node.jsView on unpkg · L2522

Findings

1 Critical4 High2 Medium5 Low

CriticalPrevious Version Dangerous Deltadist/node.js

HighChild Processdist/node.js

HighShelldist/node.js

HighCross File Remote Execution Contextdist/node.js

HighBase64 Obscured Urldist/node.js

MediumNetwork

MediumEnvironment Vars

LowEval

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

LowSuspicious Lifecycle Evidencepackage.json

Affected versions and remediation

This report applies to @uipath/project-packager@1.200.0.

See all versions of @uipath/project-packager for other recorded verdicts.

Review the evidence and your use of @uipath/project-packager@1.200.0 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-09-26 04:06:41.091Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Related packages

More from @uipath

Behavioral surface

Related packages

More from @uipath

Source & flagged code