@uipath/rpa-legacy-tool@1.199.0: Suspicious npm security report | LPM Firewall

Loading npm security reports…

@uipath/rpa-legacy-tool@1.199.0: Suspicious npm security report | LPM Firewall

Source & flagged code

6 flagged · loading source

dist/index.jsView file

757var EventEmitter = __require("node:events").EventEmitter; L758: var childProcess = __require("node:child_process"); L759: var path = __require("node:path");

High

Child Process

Package source references child process execution.

dist/index.jsView on unpkg · L757

39Cross-file remote execution chain: dist/index.js spawns dist/tool.js; helper contains network access plus dynamic code execution. L39: class CommanderError extends Error { L40: constructor(exitCode, code, message) { L41: super(message); ... L757: var EventEmitter = __require("node:events").EventEmitter; L758: var childProcess = __require("node:child_process"); L759: var path = __require("node:path"); ... L803: this._outputConfiguration = { L804: writeOut: (str) => process2.stdout.write(str), L805: writeErr: (str) => process2.stderr.write(str),

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/index.jsView on unpkg · L39

dist/tool.jsView file

123L124: // ../../node_modules/powershell-utils/index.js L125: import process3 from "node:process";

High

Shell

Package source references shell execution.

dist/tool.jsView on unpkg · L123

•Manifest-reachable source resolves another installed package, overwrites its runtime code, and injects package-defined remote behavior. dist/tool.js: // ../../node_modules/is-inside-container/node_modules/is-docker/index.js // ../../node_modules/is-inside-container/index.js // ../../node_modules/wsl-utils/node_modules/is-wsl/index.js // ../../node_modules/powershell-utils/index.js // ../../node_modules/wsl-utils/utilities.js // ../../node_modules/wsl-utils/index.js // ../../node_modules/open/node_modules/define-lazy-prop/index.js // ../../node_modules/default-browser-id/index.js

High

Entrypoint Foreign Package Code Overwrite

Manifest-reachable source overwrites another installed package with package-defined remote behavior.

dist/tool.jsView on unpkg

123L124: // ../../node_modules/powershell-utils/index.js L125: import process3 from "node:process"; ... L151: ]; L152: executePowerShell.encodeCommand = (command) => Buffer2.from(command, "utf16le").toString("base64"); L153: executePowerShell.escapeArgument = (value) => `'${String(value).replaceAll("'", "''")}'`; ... L191: const command = String.raw`(Get-ItemProperty -Path "HKCU:\Software\Microsoft\Windows\Shell\Associations\UrlAssociations\http\UserChoice").ProgId`; L192: const { stdout } = await executePowerShell(command, { powerShellPath: psPath }); L193: return stdout.trim(); ... L417: } L418: var fallbackAttemptSymbol, __dirname2, localXdgOpenPath, platform, arch, tryEachApp = async (apps, opener) => { L419: if (apps.length === 0) {

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/tool.jsView on unpkg · L123

32909var telemetryInstanceSlot = singleton("TelemetryService"); L32910: var DEFAULT_AI_CONNECTION_STRING = atob("[redacted]... L32911: function getGlobalTelemetryInstance() {

High

Base64 Obscured Url

Source decodes a Base64-obscured HTTP endpoint at runtime.

dist/tool.jsView on unpkg · L32909

Source & flagged code

6 flagged

dist/index.jsView file

Lines 19-59javascript

19 if (cached)

20 return cached;

21 }

22 target = mod != null ? __create(__getProtoOf(mod)) : {};

23 const to = isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target;

24 for (let key of __getOwnPropNames(mod))

25 if (!__hasOwnProp.call(to, key))

26 __defProp(to, key, {

27 get: __accessProp.bind(mod, key),

28 enumerable: true

29 });

30 if (canCache)

31 cache.set(mod, to);

32 return to;

33};

34var __commonJS = (cb, mod) => () => (mod || cb((mod = { exports: {} }).exports, mod), mod.exports);

35var __require = /* @__PURE__ */ createRequire(import.meta.url);

36

37// ../../node_modules/commander/lib/error.js

38var require_error = __commonJS((exports) => {

39 class CommanderError extends Error {

40 constructor(exitCode, code, message) {

41 super(message);

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/index.jsView on unpkg · L39

42 Error.captureStackTrace(this, this.constructor);

43 this.name = this.constructor.name;

44 this.code = code;

45 this.exitCode = exitCode;

46 this.nestedError = undefined;

47 }

48 }

49

50 class InvalidArgumentError extends CommanderError {

51 constructor(message) {

52 super(1, "commander.invalidArgument", message);

53 Error.captureStackTrace(this, this.constructor);

54 this.name = this.constructor.name;

55 }

56 }

57 exports.CommanderError = CommanderError;

58 exports.InvalidArgumentError = InvalidArgumentError;

59});

Lines 737-777javascript

737 });

738 similar.sort((a, b) => a.localeCompare(b));

739 if (searchingOptions) {

740 similar = similar.map((candidate) => `--${candidate}`);

dist/tool.jsView file

123L124: // ../../node_modules/powershell-utils/index.js L125: import process3 from "node:process";

High

Shell

Package source references shell execution.

dist/tool.jsView on unpkg · L123

•Manifest-reachable source resolves another installed package, overwrites its runtime code, and injects package-defined remote behavior. dist/tool.js: // ../../node_modules/is-inside-container/node_modules/is-docker/index.js // ../../node_modules/is-inside-container/index.js // ../../node_modules/wsl-utils/node_modules/is-wsl/index.js // ../../node_modules/powershell-utils/index.js // ../../node_modules/wsl-utils/utilities.js // ../../node_modules/wsl-utils/index.js // ../../node_modules/open/node_modules/define-lazy-prop/index.js // ../../node_modules/default-browser-id/index.js

High

Entrypoint Foreign Package Code Overwrite

Manifest-reachable source overwrites another installed package with package-defined remote behavior.

dist/tool.jsView on unpkg

123L124: // ../../node_modules/powershell-utils/index.js L125: import process3 from "node:process"; ... L151: ]; L152: executePowerShell.encodeCommand = (command) => Buffer2.from(command, "utf16le").toString("base64"); L153: executePowerShell.escapeArgument = (value) => `'${String(value).replaceAll("'", "''")}'`; ... L191: const command = String.raw`(Get-ItemProperty -Path "HKCU:\Software\Microsoft\Windows\Shell\Associations\UrlAssociations\http\UserChoice").ProgId`; L192: const { stdout } = await executePowerShell(command, { powerShellPath: psPath }); L193: return stdout.trim(); ... L417: } L418: var fallbackAttemptSymbol, __dirname2, localXdgOpenPath, platform, arch, tryEachApp = async (apps, opener) => { L419: if (apps.length === 0) {