registry / @uipath/project-packager / 1.202.0

@uipath/project-packager@1.202.0

UiPath Project Packager - core library for packing individual UiPath projects

AI Security Review

scanned 28d ago · by lpm-firewall-ai

Static review shows a normal UiPath project-packaging library with no lifecycle scripts and no self-install chain. Process execution and authenticated requests are limited to caller-invoked packing, signing, and publishing.

Static reason

One or more suspicious static signals were detected.

Trigger

No install, import, or hidden runtime trigger starts execution.

Impact

No unconsented mutation, credential theft, or remote payload execution was found.

Mechanism

Callers invoke exported factories that may run a fixed dotnet version check, sign packages, or upload to a destination the caller supplies.

AI rationale

Decision evidence

public snapshot

AI called this Clean at 86.0% confidence as Benign with low false-positive risk.

Evidence for AI clean decision

package.json declares a UiPath library at 1.202.0 with ESM exports and no install lifecycle scripts or self-dependency.
dist/node.js only exports packager factories and services and does not run packing or publishing at import.
The fixed dotnet version check and later process launches sit inside caller-invoked discovery, signing, and publish methods.

Evidence against

Bearer tokens and NuGet API keys are sent only to caller-supplied cloud or feed URLs during explicit publish or policy download.
Bundled open-helper process calls target local OS launchers and are not install hooks.

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

Manifest

NoLicense

scanned 3 file(s), 2.74 MB of source, external domains: github.com, npm.pkg.github.com

Source & flagged code

6 flagged

dist/node.jsView file

Lines 1271-1311javascript

1271I18nManager.registerTranslations("ja", ja_default);

1272I18nManager.registerTranslations("ko", ko_default);

1273I18nManager.registerTranslations("pt", pt_default);

1274I18nManager.registerTranslations("pt-BR", pt_BR_default);

1275I18nManager.registerTranslations("ro", ro_default);

1276I18nManager.registerTranslations("ru", ru_default);

1277I18nManager.registerTranslations("tr", tr_default);

1278I18nManager.registerTranslations("zh-CN", zh_CN_default);

1279I18nManager.registerTranslations("zh-TW", zh_TW_default);

1280I18nManager.registerTranslations("zu", zu_default);

1281

1282// ../../common/dist/index.js

1283import { createRequire } from "node:module";

1284import fs from "node:fs";

1285import fs2 from "node:fs";

1286import process2 from "node:process";

1287import os from "node:os";

1288import fs3 from "node:fs";

1289import process3 from "node:process";

1290import { Buffer as Buffer2 } from "node:buffer";

1291import { promisify } from "node:util";

1292import childProcess from "node:child_process";

1293import { promisify as promisify2 } from "node:util";

High

Child Process

Package source references child process execution.

dist/node.jsView on unpkg · L1291

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/node.jsView on unpkg · L1291

1294import childProcess2 from "node:child_process";

1295import fs4, { constants as fsConstants } from "node:fs/promises";

1296import { promisify as promisify3 } from "node:util";

1297import process4 from "node:process";

1298import { execFile as execFile3 } from "node:child_process";

1299import process5 from "node:process";

1300import { promisify as promisify4 } from "node:util";

1301import { execFile as execFile4, execFileSync } from "node:child_process";

1302import { promisify as promisify5 } from "node:util";

1303import { execFile as execFile5 } from "node:child_process";

1304import { promisify as promisify6 } from "node:util";

1305import process6 from "node:process";

1306import { execFile as execFile6 } from "node:child_process";

1307import process7 from "node:process";

1308import process8 from "node:process";

1309import path from "node:path";

1310import { fileURLToPath } from "node:url";

1311import childProcess3 from "node:child_process";

Lines 1414-1454javascript

1414 if (isInsideContainer()) {

1415 return false;

1416 }

1417 return true;

1418 }

1419 try {

1420 if (fs3.

Lines 10527-10567javascript

10527}

10528function invocationElapsedMs() {

10529 return performance.now() - getState().baseline;

10530}

10531function markCommandStart() {

10532 if (!timingsEnabled

Lines 13692-13732javascript

13692}

13693

13694// src/publish/node-project-publisher-factory.ts

13695class NodeProjectPublisherFactory extends BaseNodePackagerFactory {

13696 async createAsync(config) {

13697 const logger2 =

package.jsonView file

Lines 1-21json

2 "name": "@uipath/project-packager",

3 "license": "SEE LICENSE IN LICENSE.txt",

4 "version": "1.202.0",

5 "description": "UiPath Project Packager - core library for packing individual UiPath projects",

Source & flagged code

6 flagged · loading source

dist/node.jsView file

1291import { promisify } from "node:util"; L1292: import childProcess from "node:child_process"; L1293: import { promisify as promisify2 } from "node:util";

High

Child Process

Package source references child process execution.

dist/node.jsView on unpkg · L1291

1434var execFile; L1435: var powerShellPath = () => `${process3.env.SYSTEMROOT || process3.env.windir || String.raw`C:\Windows`}\\System32\\WindowsPowerShell\\v1.0\\powershell.exe`; L1436: var executePowerShell = async (command, options = {}) => {

High

Shell

Package source references shell execution.

dist/node.jsView on unpkg · L1434

1291Cross-file remote execution chain: dist/node.js spawns dist/browser.js; helper contains network access plus dynamic code execution. L1291: import { promisify } from "node:util"; L1292: import childProcess from "node:child_process"; L1293: import { promisify as promisify2 } from "node:util"; ... L1458: ]; L1459: executePowerShell.encodeCommand = (command) => Buffer2.from(command, "utf16le").toString("base64"); L1460: executePowerShell.escapeArgument = (value) => `'${String(value).replaceAll("'", "''")}'`; ... L1497: const command = String.raw`(Get-ItemProperty -Path "HKCU:\Software\Microsoft\Windows\Shell\Associations\UrlAssociations\http\UserChoice").ProgId`; L1498: const { stdout } = await executePowerShell(command, { powerShellPath: psPath }); L1499: return stdout.trim(); ... L1703: var

Findings

4 High2 Medium6 Low

HighChild Processdist/node.js

HighShelldist/node.js

HighCross File Remote Execution Contextdist/node.js

HighBase64 Obscured Urldist/node.js

MediumNetwork

MediumEnvironment Vars

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

LowNo License

LowSuspicious Lifecycle Evidencepackage.json

LowAi Review Evidencedist/node.js

Affected versions and remediation

This report applies to @uipath/project-packager@1.202.0.

See all versions of @uipath/project-packager for other recorded verdicts.

Review the evidence and your use of @uipath/project-packager@1.202.0 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-09-26 04:06:35.875Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Related packages

More from @uipath

Behavioral surface

Related packages

More from @uipath

Source & flagged code