registry / @uipath/resourcecatalog-tool / 1.202.0

@uipath/resourcecatalog-tool@1.202.0

CLI plugin for the UiPath Resource Catalog Service.

AI Security Review

scanned 28d ago · by lpm-firewall-ai

Static inspection found a lifecycle-free CLI package with user-invoked Resource Catalog commands and normal authentication behavior. No concrete malicious behavior was identified.

Static reason

One or more suspicious static signals were detected.

Trigger

A user runs the installed CLI and selects an RCS command.

Impact

No unconsented install-time execution, persistence, destructive action, or credential exfiltration was established.

Mechanism

The commands construct a configured API client; authentication refresh sends a token request to the configured identity endpoint.

AI rationale

Static inspection found a lifecycle-free CLI package with user-invoked Resource Catalog commands and normal authentication behavior. No concrete malicious behavior was identified.

Network endpoints1

cloud.uipath.com

Decision evidence

public snapshot

AI called this Clean at 94.0% confidence as Benign with low false-positive risk.

Evidence for AI clean decision

The manifest defines module and CLI entry points and contains no lifecycle hook.
The runtime registers Resource Catalog commands under the admin prefix.
The search command creates an API client and performs a user-selected resource search.
The auxiliary chunk exports an open helper; it does not invoke it during import.
Token refresh posts to the configured identity token endpoint as part of authentication.

Evidence against

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

Manifest

NoLicense

scanned 7 file(s), 486 KB of source, external domains: cloud.uipath.com, github.com, govcloud.uipath.us, npm.pkg.github.com

Source & flagged code

6 flagged

dist/tool-c25x4h9p.jsView file

Lines 4338-4378javascript

4338 }

4339 getState().commandStart = performance.now();

4340}

4341function recordCommandDuration(durationMs) {

4342 if (!timingsEnabled()) {

4343 return;

4344 }

4345 getState().commandMs = durationMs;

4346}

4347// ../../common/src/telemetry/proxy-http-agent.ts

4348var slot = singleton("ProxyAuthHttpsAgent");

4349

4350// ../../common/src/telemetry/node-appinsights-telemetry-provider.ts

4351var providerSlot = singleton("TelemetryProvider");

4352

4353// ../../common/src/telemetry/telemetry-spool.ts

4354var sidecarEntrySlot = singleton("TelemetrySidecarEntry");

4355var MAX_SPOOL_AGE_MS = 72 * 60 * 60 * 1000;

4356

4357// ../../common/src/telemetry/telemetry-init.ts

4358var telemetryInstanceSlot = singleton("TelemetryService");

4359var DEFAULT_AI_CONNECTION_STRING = atob("SW5zdHJ1bWVudGF0aW9uS2V5PTliZDM3NDgyLTgxMGUtNDQyYS1hYWE2LWQzOGVmNjVjNjY3NDtJbmdlc3Rpb25FbmRwb2ludD1odHRwczovL3dlc3RldXJvcGUtNS5pbi5hcHBsaWNhdGlvbmluc2lnaHRzLmF6dXJlLmNvbS87TGl2ZUVuZHBvaW50PWh0dHBzOi8vd2VzdGV1cm9wZS5saXZlZGlhZ25vc3RpY3MubW9uaXRvci5henVyZS5jb20vO0FwcGxpY2F0aW9uSWQ9MzU2OTdlZjEtOGJkMC00ZjE5LWEyN2MtZDg3Y2NhYzY2ZDJj");

4360function getGlobalTelemetryInstance() {

High

Base64 Obscured Url

Source decodes a Base64-obscured HTTP endpoint at runtime.

dist/tool-c25x4h9p.jsView on unpkg · L4358

4361 const existing = telemetryInstanceSlot.get();

4362 if (existing && typeof existing === "object" && "trackEvent" in existing && typeof existing.trackEvent === "function") {

4363 return existing;

4364 }

4365 return;

4366}

4367function setGlobalTelemetryInstance(instance) {

4368 telemetryInstanceSlot.set(instance);

4369}

4370var _localTelemetryInstance;

4371function getTelemetryInstance() {

4372 const global = getGlobalTelemetryInstance();

4373 if (global)

4374 return global;

4375 if (!_localTelemetryInstance) {

4376 _localTelemetryInstance = new TelemetryService(new LoggerTelemetryProvider, new NodeContextStorage);

4377 setGlobalTelemetryInstance(_localTelemetryInstance);

4378 }

Lines 8771-8811javascript

8771 }

8772 if (!status.organizationId) {

8773 throw new Error("Organization ID not available. Ensure you are logged in with an organization context.");

8774 }

8775 const tenant = options?.tenantName ?? status.tenantName;

Lines 8993-9030javascript

8993 }

8994 OutputFormatter.success({

8995 Result: RESULTS.Success,

8996 Code: "RcsTagList",

8997 Data: result

8998 });

8999 });

9000};

9001

9002// src/commands/rcs.ts

9003var

dist/index-xnzgkhtg.jsView file

Lines 536-576javascript

536 subprocess.once("spawn", () => {

537 subprocess.off("error", reject);

538 resolve(subprocess);

539 });

540 });

541};

542var

package.jsonView file

Lines 1-21json

2 "name": "@uipath/resourcecatalog-tool",

3 "license": "SEE LICENSE IN LICENSE.txt",

4 "version": "1.202.0",

5 "description": "CLI plugin for the UiPath Resource Catalog Service.",

Source & flagged code

6 flagged · loading source

dist/tool-c25x4h9p.jsView file

4358var telemetryInstanceSlot = singleton("TelemetryService"); L4359: var DEFAULT_AI_CONNECTION_STRING = atob("[redacted]... L4360: function getGlobalTelemetryInstance() {

High

Base64 Obscured Url

Source decodes a Base64-obscured HTTP endpoint at runtime.

dist/tool-c25x4h9p.jsView on unpkg · L4358

9013; }; // src/tool.ts var metadata = { name: "resourcecatalog-tool", version: package_default.version, description: "Manage UiPath Resource Catalog Service resources.", commandPrefix: "admin" }; var registerCommands = async (program2) => { registerRcsCommand(program2); }; export { Command,

Low

Ai Review Evidence

The runtime registers Resource Catalog commands under the admin prefix.

dist/tool-c25x4h9p.jsView on unpkg · L9013

8791createApiClient(ApiClass, options) { const { config, organizationId, tenantName } = await resolveConfig(options); return { api: new ApiClass(config), organizationId, tenantName }; } // src/commands/search.ts var LOGIN_INST

Low

Ai Review Evidence

The search command creates an API client and performs a user-selected resource search.

Findings

2 High2 Medium8 Low

HighBase64 Obscured Urldist/tool-c25x4h9p.js

HighSemantic Analysis Limiteddist/index-xnzgkhtg.js

MediumNetwork

MediumEnvironment Vars

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

LowNo License

LowSuspicious Lifecycle Evidencepackage.json

LowAi Review Evidencedist/tool-c25x4h9p.js

LowAi Review Evidencedist/index-xnzgkhtg.js

Affected versions and remediation

This report applies to @uipath/resourcecatalog-tool@1.202.0.

See all versions of @uipath/resourcecatalog-tool for other recorded verdicts.

Review the evidence and your use of @uipath/resourcecatalog-tool@1.202.0 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-09-26 03:50:04.303Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Related packages

More from @uipath

Behavioral surface

Related packages

More from @uipath

Source & flagged code