registry / @uipath/resourcecatalog-tool / 1.203.0

@uipath/resourcecatalog-tool@1.203.0

CLI plugin for the UiPath Resource Catalog Service.

AI Security Review

scanned 14d ago · by lpm-firewall-ai

The manifest has no lifecycle scripts, and the flagged endpoint string is an unused telemetry connection string in the inspected bundle. The inspected telemetry provider logs locally, and the CLI bundle shows no attack behavior.

Static reason

One or more suspicious static signals were detected.

Trigger

Importing the package or invoking its CLI entrypoint.

Impact

No confirmed attack surface was established.

Mechanism

The inspected telemetry provider sends event information to the local logger; the connection string declaration has no other match in the bundle.

AI rationale

Decision evidence

public snapshot

AI called this Clean at 86.0% confidence as Benign with low false-positive risk.

Evidence for AI clean decision

package.json declares module entrypoints and no install lifecycle hooks.
The flagged bundle contains an encoded telemetry connection string, but the inspected telemetry provider logs events locally.
The CLI entrypoint imports a bundled dependency; no attack behavior was identified in the inspected launcher source.

Evidence against

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetwork

Supply chain

HighEntropyStringsUrlStrings

Manifest

NoLicense

scanned 7 file(s), 501 KB of source, external domains: cloud.uipath.com, github.com, govcloud.uipath.us, npm.pkg.github.com

Source & flagged code

6 flagged

dist/tool-nkdmj5er.jsView file

Lines 3800-3840javascript

3800 }));

3801 if (error) {

3802 return "";

3803 }

3804 const match = output.match(new RegExp(`${valueName}\\s+REG_SZ\\s+(.+)`));

3805 return match?.[1]?.trim() ?? "";

3806}

3807

3808// ../../common/src/telemetry/logger-telemetry-provider.ts

3809class LoggerTelemetryProvider {

3810 analyticsUniqueId;

3811 constructor() {

3812 this.analyticsUniqueId = readRegistryValue("HKCU\\Software\\UiPath", "AnalyticsUniqueId");

3813 }

3814 enrich(properties) {

3815 return {

3816 ...properties,

3817 ...this.analyticsUniqueId ? { analyticsUniqueId: this.analyticsUniqueId } : {}

3818 };

3819 }

3820 async trackEvent({ name, properties }) {

3821 logger.debug(formatMessage("Event", name, this.enrich(properties)));

3822 }

3823 async trackException({

3824 error,

3825 properties

3826 }) {

Low

Ai Review Evidence

The flagged bundle contains an encoded telemetry connection string, but the inspected telemetry provider logs events locally.

dist/tool-nkdmj5er.jsView on unpkg · L3820

3827 logger.error(formatMessage("Exception", error.message, this.enrich({

3828 ...properties,

3829 stack: error.stack

3830 })));

3831 }

3832 async trackRequest({

3833 name,

3834 durationMs,

3835 success,

3836 properties

3837 }) {

3838 logger.debug(formatMessage("Request", name, this.enrich({

3839 ...properties,

3840 duration: `${durationMs}ms`,

Lines 4360-4401javascript

4360 }

4361 getState().commandStart = performance.now();

4362}

4363function recordCommandDuration(durationMs) {

4364 if (!timingsEnabled()) {

4365 return;

dist/index-xnzgkhtg.jsView file

Lines 1-21javascript

1import"./tool-1de529jm.js";

3// ../../../node_modules/open/index.js

4import process7 from "node:process";

5import path from "node:path";

Low

Suspicious Dependency Evidence

The CLI entrypoint imports a bundled dependency; no attack behavior was identified in the inspected launcher source.

dist/index-xnzgkhtg.jsView on unpkg · L1

package.jsonView file

Lines 1-32json

2 "name": "@uipath/resourcecatalog-tool",

3 "author": "UiPath",

4 "license": "SEE LICENSE IN LICENSE.txt",

5 "version": "1.203.0",

Source & flagged code

6 flagged · loading source

dist/tool-nkdmj5er.jsView file

4380var telemetryInstanceSlot = singleton("TelemetryService"); L4381: var DEFAULT_AI_CONNECTION_STRING = atob("[redacted]... L4382: function getGlobalTelemetryInstance() {

High

Base64 Obscured Url

Source decodes a Base64-obscured HTTP endpoint at runtime.

dist/tool-nkdmj5er.jsView on unpkg · L4380

4381var DEFAULT_AI_CONNECTION_STRING = atob("[redacted]

Low

Ai Review Evidence

The flagged bundle contains an encoded telemetry connection string, but the inspected telemetry provider logs events locally.

dist/tool-nkdmj5er.jsView on unpkg · L4381

3820async trackEvent({ name, properties }) { logger.debug(formatMessage("Event", name, this.enrich(properties))); } async trackException({ error, properties })

Low

Ai Review Evidence

The flagged bundle contains an encoded telemetry connection string, but the inspected telemetry provider logs events locally.

dist/tool-nkdmj5er.jsView on unpkg · L3820

Findings

2 High2 Medium8 Low

HighBase64 Obscured Urldist/tool-nkdmj5er.js

HighSemantic Analysis Limiteddist/index-xnzgkhtg.js

MediumNetwork

MediumEnvironment Vars

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

LowNo License

LowSuspicious Lifecycle Evidencepackage.json

LowAi Review Evidencedist/tool-nkdmj5er.js

LowSuspicious Dependency Evidencedist/index-xnzgkhtg.js

LowAi Review Evidencedist/tool-nkdmj5er.js

Affected versions and remediation

This report applies to @uipath/resourcecatalog-tool@1.203.0.

See all versions of @uipath/resourcecatalog-tool for other recorded verdicts.

Review the evidence and your use of @uipath/resourcecatalog-tool@1.203.0 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-10-09 16:52:16.109Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Related packages

More from @uipath

Behavioral surface

Related packages

More from @uipath

Source & flagged code