@uipath/rpa-tool@1.199.0: Clean npm security report (Allow) | LPM Firewall

Loading npm security reports…

@uipath/rpa-tool@1.199.0: Clean npm security report (Allow) | LPM Firewall

Source & flagged code

8 flagged · loading source

dist/packager-tool.jsView file

89return e5[t4]; L90: } }, c = Object.getPrototypeOf(Function), l = typeof process == "object" && process.env && process.env.REFLECT_METADATA_USE_MAP_POLYFILL === "true", f = l || typeof Map != "functio... L91: var e5 = {}, t4 = [], r3 = function() { ... L6031: } L6032: isWebSocket(e3) { L6033: this._address = new o.NodeWebSocketAddress(e3); ... L6135: e3.current = function() { L6136: switch (process.platform === "win32" ? t3.Windows : t3.Linux) { L6137: case t3.Windows: ... L6293: return yield new Promise((t4, r2) => { L6294: this._socketLike.write(e3, (e4) => e4 ? r2(e4) : t4()); L6295: });

Critical

Command Output Exfiltration

Source executes local commands and sends command output to an external endpoint.

dist/packager-tool.jsView on unpkg · L89

10345import { promisify as promisify7 } from "node:util"; L10346: import childProcess4 from "node:child_process"; L10347: import { promisify as promisify22 } from "node:util";

High

Child Process

Package source references child process execution.

dist/packager-tool.jsView on unpkg · L10345

11901return false; L11902: }, is_wsl_default2, init_is_wsl, execFile7, powerShellPath3 = () => `${process32.env.SYSTEMROOT || process32.env.windir || String.raw`C:\Windows`}\\System32\\WindowsPowerShell\\v1.... L11903: const {

High

Shell

Package source references shell execution.

dist/packager-tool.jsView on unpkg · L11901

43557var telemetryInstanceSlot = singleton2("TelemetryService"); L43558: var DEFAULT_AI_CONNECTION_STRING = atob("[redacted]... L43559: function getGlobalTelemetryInstance() {

High

Base64 Obscured Url

Source decodes a Base64-obscured HTTP endpoint at runtime.

dist/packager-tool.jsView on unpkg · L43557

dist/tool.jsView file

61Trigger-reachable chain: manifest.main -> dist/tool.js L61: class CommanderError2 extends Error { L62: constructor(exitCode, code, message) { L63: super(message); ... L779: var EventEmitter = __require("node:events").EventEmitter; L780: var childProcess4 = __require("node:child_process"); L781: var path3 = __require("node:path"); ... L825: this._outputConfiguration = { L826: writeOut: (str2) => process9.stdout.write(str2), L827: writeErr: (str2) => process9.stderr.write(str2), ... L2446: tmpdir: os22.tmpdir, L2447: getenv: (key) => process.env[key] L2448: };

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/tool.jsView on unpkg · L61

•matchType = previous_version_dangerous_delta matchedPackage = @uipath/rpa-tool@1.198.1 matchedIdentity = npm:QHVpcGF0aC9ycGEtdG9vbA:1.198.1 similarity = 1.000 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/tool.jsView on unpkg

61932const spawnEnv = needsCustomEnv ? { L61933: ...process.env, L61934: ...process.platform !== "win32" && { ... L61938: } : undefined; L61939: const child = spawn(exe, args, { L61940: detached: true, ... L61946: sleep(ms) { L61947: return new Promise((resolve4) => setTimeout(resolve4, ms)); L61948: },

High

Same File Env Network Execution

dist/index.jsView file

38Cross-file remote execution chain: dist/index.js spawns dist/tool.js; helper contains network access plus dynamic code execution. L38: class CommanderError extends Error { L39: constructor(exitCode, code, message) { L40: super(message); ... L756: var EventEmitter = __require("node:events").EventEmitter; L757: var childProcess = __require("node:child_process"); L758: var path = __require("node:path"); ... L802: this._outputConfiguration = { L803: writeOut: (str) => process2.stdout.write(str), L804: writeErr: (str) => process2.stderr.write(str), ... L2153: function computeSafeTmpDir(real, linkPath) { L2154: if (process.platform === "win32" || real.length <= MAX_SAFE_TMPDIR_LEN) { L2155: return withTrailingSeparator(real);

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/index.jsView on unpkg · L38

Source & flagged code

8 flagged

dist/packager-tool.jsView file

89return e5[t4]; L90: } }, c = Object.getPrototypeOf(Function), l = typeof process == "object" && process.env && process.env.REFLECT_METADATA_USE_MAP_POLYFILL === "true", f = l || typeof Map != "functio... L91: var e5 = {}, t4 = [], r3 = function() { ... L6031: } L6032: isWebSocket(e3) { L6033: this._address = new o.NodeWebSocketAddress(e3); ... L6135: e3.current = function() { L6136: switch (process.platform === "win32" ? t3.Windows : t3.Linux) { L6137: case t3.Windows: ... L6293: return yield new Promise((t4, r2) => { L6294: this._socketLike.write(e3, (e4) => e4 ? r2(e4) : t4()); L6295: });

Critical

Command Output Exfiltration

Source executes local commands and sends command output to an external endpoint.

dist/packager-tool.jsView on unpkg · L89

10345import { promisify as promisify7 } from "node:util"; L10346: import childProcess4 from "node:child_process"; L10347: import { promisify as promisify22 } from "node:util";

High

Child Process

Package source references child process execution.

dist/packager-tool.jsView on unpkg · L10345

11901return false; L11902: }, is_wsl_default2, init_is_wsl, execFile7, powerShellPath3 = () => `${process32.env.SYSTEMROOT || process32.env.windir || String.raw`C:\Windows`}\\System32\\WindowsPowerShell\\v1.... L11903: const {

High

Shell

Package source references shell execution.

dist/packager-tool.jsView on unpkg · L11901

43557var telemetryInstanceSlot = singleton2("TelemetryService"); L43558: var DEFAULT_AI_CONNECTION_STRING = atob("[redacted]... L43559: function getGlobalTelemetryInstance() {

High

Base64 Obscured Url

Source decodes a Base64-obscured HTTP endpoint at runtime.

dist/packager-tool.jsView on unpkg · L43557

dist/tool.jsView file

61Trigger-reachable chain: manifest.main -> dist/tool.js L61: class CommanderError2 extends Error { L62: constructor(exitCode, code, message) { L63: super(message); ... L779: var EventEmitter = __require("node:events").EventEmitter; L780: var childProcess4 = __require("node:child_process"); L781: var path3 = __require("node:path"); ... L825: this._outputConfiguration = { L826: writeOut: (str2) => process9.stdout.write(str2), L827: writeErr: (str2) => process9.stderr.write(str2), ... L2446: tmpdir: os22.tmpdir, L2447: getenv: (key) => process.env[key] L2448: };

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/tool.jsView on unpkg · L61

•matchType = previous_version_dangerous_delta matchedPackage = @uipath/rpa-tool@1.198.1 matchedIdentity = npm:QHVpcGF0aC9ycGEtdG9vbA:1.198.1 similarity = 1.000 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/tool.jsView on unpkg

61932const spawnEnv = needsCustomEnv ? { L61933: ...process.env, L61934: ...process.platform !== "win32" && { ... L61938: } : undefined; L61939: const child = spawn(exe, args, { L61940: detached: true, ... L61946: sleep(ms) { L61947: return new Promise((resolve4) => setTimeout(resolve4, ms)); L61948: },

High

Same File Env Network Execution

dist/index.jsView file

Lines 18-58javascript

18 if (cached)

19 return cached;

20 }

21 target = mod != null ? __create(__getProtoOf(mod)) : {};

22