registry / @uipath/resourcecatalog-tool / 1.200.0

@uipath/resourcecatalog-tool@1.200.0

CLI plugin for the UiPath Resource Catalog Service.

AI Security Review

scanned 28d ago · by lpm-firewall-ai

Static inspection found a normal user-invoked CLI with no lifecycle hook. Its authenticated API setup is tied to existing login status and Resource Catalog commands.

Static reason

One or more suspicious static signals were detected.

Trigger

The user runs the package CLI with a Resource Catalog command.

Impact

No unconsented installation-time action, credential harvesting, or unrelated network destination was confirmed.

Mechanism

Commands are registered and parsed at runtime; requests require an existing logged-in configuration.

AI rationale

Static inspection found a normal user-invoked CLI with no lifecycle hook. Its authenticated API setup is tied to existing login status and Resource Catalog commands.

Decision evidence

public snapshot

AI called this Clean at 95.0% confidence as Benign with low false-positive risk.

Evidence for AI clean decision

The manifest defines module and CLI entrypoints but no lifecycle scripts.
The CLI requires an existing logged-in status with a base URL and access token before creating its API client.
The executable registers Resource Catalog search and tag commands, then parses command-line arguments.

Evidence against

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetwork

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 2 file(s), 856 KB of source, external domains: cloud.uipath.com, github.com, govcloud.uipath.us, npm.pkg.github.com

Source & flagged code

6 flagged

dist/index.jsView file

Lines 19-59javascript

19 return cached;

20 }

21 target = mod != null ? __create(__getProtoOf(mod)) : {};

22 const to = isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target;

23 for (let key of __getOwnPropNames(mod))

24 if (!__hasOwnProp.call(to, key))

25 __defProp(to, key, {

26 get: __accessProp.bind(mod, key),

27 enumerable: true

28 });

29 if (canCache)

30 cache.set(mod, to);

31 return to;

32};

33var __commonJS = (cb, mod) => () => (mod || cb((mod = { exports: {} }).exports, mod), mod.exports);

34var __esm = (fn, res) => () => (fn && (res = fn(fn = 0)), res);

35var __require = /* @__PURE__ */ createRequire(import.meta.url);

37// ../../../node_modules/commander/lib/error.js

38var require_error = __commonJS((exports) => {

39 class CommanderError extends Error {

40 constructor(exitCode, code, message) {

41 super(message);

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/index.jsView on unpkg · L39

42 Error.captureStackTrace(this, this.constructor);

43 this.name = this.constructor.name;

44 this.code = code;

45 this.exitCode = exitCode;

46 this.nestedError = undefined;

47 }

48 }

50 class InvalidArgumentError extends CommanderError {

51 constructor(message) {

52 super(1, "commander.invalidArgument", message);

53 Error.captureStackTrace(this, this.constructor);

54 this.name = this.constructor.name;

55 }

56 }

57 exports.CommanderError = CommanderError;

58 exports.InvalidArgumentError = InvalidArgumentError;

59});

Lines 737-777javascript

737 });

738 similar.sort((a, b) => a.localeCompare(b));

739 if (searchingOptions) {

740 similar = similar.map((candidate) => `--${candidate}`);

Lines 9604-9644javascript

9604 let hex = "";

9605 do {

9606 crypto.getRandomValues(bytes);

9607 hex = "";

9608 for (const byte of

Lines 13511-13551javascript

13511// ../../auth/src/index.ts

13512init_constants();

13513

13514// ../../auth/src/interactive.ts

13515init_src();

13516

13517// ../../auth/src/selectTenant.ts

13518var TENANT_SELECTION_REQUIRED_CODE = "TENANT_SELECTION_REQUIRED";

13519var INVALID_TENANT_CODE

Lines 13748-13788javascript

13748 skip: offset.value ?? 0

13749 });

13750 })());

13751 if (error) {

13752 OutputFormatter.error({

13753 Result: RESULTS.Failure,

13754 Message: await extractErrorMessage(error),

package.jsonView file

Lines 1-31json

2 "name": "@uipath/resourcecatalog-tool",

3 "license": "MIT",

4 "version": "1.200.0",

5 "description": "CLI plugin for the UiPath Resource Catalog Service.",

Source & flagged code

6 flagged · loading source

dist/index.jsView file

757var EventEmitter = __require("node:events").EventEmitter; L758: var childProcess = __require("node:child_process"); L759: var path = __require("node:path");

High

Child Process

Package source references child process execution.

dist/index.jsView on unpkg · L757

39Cross-file remote execution chain: dist/index.js spawns dist/tool.js; helper contains network access plus dynamic code execution. L39: class CommanderError extends Error { L40: constructor(exitCode, code, message) { L41: super(message); ... L757: var EventEmitter = __require("node:events").EventEmitter; L758: var childProcess = __require("node:child_process"); L759: var path = __require("node:path"); ... L803: this._outputConfiguration = { L804: writeOut: (str) => process2.stdout.write(str), L805: writeErr: (str) => process2.stderr.write(str), ... L2232: ]; L2233: executePowerShell.encodeCommand = (command) => Buffer2.from(command, "utf16le").toString("base64"); L2234: executePowerShell.escapeArgument = (value) => `'${String(value).replaceAll("'", "''")}'`;

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/index.jsView on unpkg · L39

9624var telemetryInstanceSlot = singleton("TelemetryService"); L9625: var DEFAULT_AI_CONNECTION_STRING = atob("[redacted]... L9626: function getGlobalTelemetryInstance() {

Findings

3 High2 Medium6 Low

HighChild Processdist/index.js

HighCross File Remote Execution Contextdist/index.js

HighBase64 Obscured Urldist/index.js

MediumNetwork

MediumEnvironment Vars

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

LowSuspicious Lifecycle Evidencepackage.json

LowAi Review Evidencedist/index.js

Affected versions and remediation

This report applies to @uipath/resourcecatalog-tool@1.200.0.

See all versions of @uipath/resourcecatalog-tool for other recorded verdicts.

Review the evidence and your use of @uipath/resourcecatalog-tool@1.200.0 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-09-26 03:49:21.544Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Related packages

More from @uipath

Behavioral surface

Related packages

More from @uipath

Source & flagged code