registry / @uipath/project-packager / 1.201.0

@uipath/project-packager@1.201.0

UiPath Project Packager - core library for packing individual UiPath projects

AI Security Review

scanned 2mo ago · by lpm-firewall-ai

The high-risk primitives are consistent with a project packager's explicit signing and publishing features, and there is no install-time execution or hidden payload chain. The encoded telemetry setting alone does not establish malicious behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Trigger

A caller explicitly invokes package publishing, signing, or telemetry-enabled library operations.

Impact

The caller-selected package and supplied authentication data can be sent to the caller-provided destination.

Mechanism

Publishes caller-selected packages and optionally runs dotnet signing.

AI rationale

Evidence

dist/node.jspackage.json

Decision evidence

public snapshot

AI called this Clean at 94.0% confidence as Benign with low false-positive risk.

Evidence for AI clean decision

The bundle includes an encoded telemetry configuration.
The Node entrypoint invokes dotnet for package signing with shell execution disabled.
Publishing sends package files and supplied credentials only to caller-provided feed or Orchestrator URLs.

Evidence against

package.json has no preinstall, install, postinstall, or other lifecycle script.
The manifest exposes library entrypoints rather than an automatically run binary.
No self-dependency, remote payload loader, credential harvesting, or destructive action was found.

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 3 file(s), 2.71 MB of source, external domains: feross.org, github.com, npm.pkg.github.com

Source & flagged code

7 flagged

dist/node.jsView file

Lines 1271-1311javascript

1271I18nManager.registerTranslations("ja", ja_default);

1272I18nManager.registerTranslations("ko", ko_default);

1273I18nManager.registerTranslations("pt", pt_default);

1274I18nManager.registerTranslations("pt-BR", pt_BR_default);

1275I18nManager.registerTranslations("ro", ro_default);

1276I18nManager.registerTranslations("ru", ru_default);

1277I18nManager.registerTranslations("tr", tr_default);

1278I18nManager.registerTranslations("zh-CN", zh_CN_default);

1279I18nManager.registerTranslations("zh-TW", zh_TW_default);

1280I18nManager.registerTranslations("zu", zu_default);

1281

1282// ../../common/dist/index.js

1283import { createRequire } from "node:module";

1284import fs from "node:fs";

1285import fs2 from "node:fs";

1286import process2 from "node:process";

1287import os from "node:os";

1288import fs3 from "node:fs";

1289import process3 from "node:process";

1290import { Buffer as Buffer2 } from "node:buffer";

1291import { promisify } from "node:util";

1292import childProcess from "node:child_process";

1293import { promisify as promisify2 } from "node:util";

High

Child Process

Package source references child process execution.

dist/node.jsView on unpkg · L1291

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/node.jsView on unpkg · L1291

1294import childProcess2 from "node:child_process";

1295import fs4, { constants as fsConstants } from "node:fs/promises";

1296import { promisify as promisify3 } from "node:util";

1297import process4 from "node:process";

1298import { execFile as execFile3 } from "node:child_process";

1299import process5 from "node:process";

1300import { promisify as promisify4 } from "node:util";

1301import { execFile as execFile4, execFileSync } from "node:child_process";

1302import { promisify as promisify5 } from "node:util";

1303import { execFile as execFile5 } from "node:child_process";

1304import { promisify as promisify6 } from "node:util";

1305import process6 from "node:process";

1306import { execFile as execFile6 } from "node:child_process";

1307import process7 from "node:process";

1308import process8 from "node:process";

1309import path from "node:path";

1310import { fileURLToPath } from "node:url";

1311import childProcess3 from "node:child_process";

Lines 1412-1452javascript

1412 if (isInsideContainer()) {

1413 return false;

1414 }

1415 return true;

1416 }

1417 try {

1418 if (fs3.

Lines 10673-10717javascript

10673 [TELEMETRY_OPERATION_ID_PROPERTY]: context.operationId,

10674 ...context.parentId !== undefined ? { [TELEMETRY_PARENT_ID_PROPERTY]: context.parentId } : {},

10675 [TELEMETRY_SPAN_ID_PROPERTY]: context.id

10676 } : {}

10677 };

10678 return

Lines 11866-11906javascript

11866 translate as translate2

11867} from "@uipath/solutionpackager-tool-core";

11868

11869class NodePackageSignService {

11870 dotnetDiscovery;

11871 logger;

11872 constructor(dotnetDiscovery,

•matchType = previous_version_dangerous_delta matchedPackage = @uipath/project-packager@1.199.0 matchedIdentity = npm:[redacted]:1.199.0 similarity = 0.667 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/node.jsView on unpkg

Source & flagged code

7 flagged · loading source

dist/node.jsView file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/node.jsView on unpkg

1291import { promisify } from "node:util"; L1292: import childProcess from "node:child_process"; L1293: import { promisify as promisify2 } from "node:util";

High

Child Process

Package source references child process execution.

dist/node.jsView on unpkg · L1291

1432var execFile; L1433: var powerShellPath = () => `${process3.env.SYSTEMROOT || process3.env.windir || String.raw`C:\Windows`}\\System32\\WindowsPowerShell\\v1.0\\powershell.exe`; L1434: var executePowerShell = async (command, options = {}) => {

High

Shell

Package source references shell execution.

dist/node.jsView on unpkg · L1432

Findings

1 Critical4 High2 Medium5 Low

CriticalPrevious Version Dangerous Deltadist/node.js

HighChild Processdist/node.js

HighShelldist/node.js

HighCross File Remote Execution Contextdist/node.js

HighBase64 Obscured Urldist/node.js

MediumNetwork

MediumEnvironment Vars

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

LowAi Review Evidencedist/node.js

Affected versions and remediation

This report applies to @uipath/project-packager@1.201.0.

See all versions of @uipath/project-packager for other recorded verdicts.

Review the evidence and your use of @uipath/project-packager@1.201.0 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-09-07 13:54:08.863Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Related packages

More from @uipath

Behavioral surface

Related packages

More from @uipath

Source & flagged code