@uipath/rpa-tool@1.200.1: Clean npm security report (Allow) | LPM Firewall

Loading npm security reports…

@uipath/rpa-tool@1.200.1: Clean npm security report (Allow) | LPM Firewall

Source & flagged code

8 flagged · loading source

dist/packager-tool.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @uipath/rpa-tool@1.199.0 matchedIdentity = npm:QHVpcGF0aC9ycGEtdG9vbA:1.199.0 similarity = 1.000 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/packager-tool.jsView on unpkg

1059// node_modules/@uipath/packager-tool-workflowcompiler/dist/index.js L1060: import { execSync } from "node:child_process"; L1061: import { spawn } from "node:child_process";

High

Child Process

Package source references child process execution.

dist/packager-tool.jsView on unpkg · L1059

4019} L4020: const execArgv = process9.execArgv ?? []; L4021: if (execArgv.includes("-e") || execArgv.includes("--eval") || execArgv.includes("-p") || execArgv.includes("--print")) {

High

Shell

Package source references shell execution.

dist/packager-tool.jsView on unpkg · L4019

•Manifest-reachable source resolves another installed package, overwrites its runtime code, and injects package-defined remote behavior. dist/packager-tool.js: // node_modules/@uipath/solutionpackager-tool-core/dist/index.js // node_modules/@uipath/packager-tool-workflowcompiler/dist/index.js dotnetNotAvailable: "The .NET SDK 8.0 is required by the workflow compiler, but the 'dotnet' CLI was not found on PATH. Install SDK 8.0 from https://dotnet.microsoft.com/download/d... dotnetNotAvailable: "The .NET SDK 8.0 is required by the workflow compiler, but the 'dotnet' CLI was not found on PATH. Install SDK 8.0 from https://dotnet.microsoft.com/download/d... dotnetNotAvailable: "The .NET SDK 8.0 is required by the workflow compiler, but the 'dotnet' CLI was not found on PATH. Install SDK 8.0 fro

High

Entrypoint Foreign Package Code Overwrite

Manifest-reachable source overwrites another installed package with package-defined remote behavior.

dist/packager-tool.jsView on unpkg

11900var telemetryInstanceSlot = singleton2("TelemetryService"); L11901: var DEFAULT_AI_CONNECTION_STRING = atob("[redacted]... L11902: function getGlobalTelemetryInstance() {

High

Base64 Obscured Url

Source decodes a Base64-obscured HTTP endpoint at runtime.

dist/packager-tool.jsView on unpkg · L11900

dist/tool.jsView file

44592const spawnEnv = needsCustomEnv ? { L44593: ...process.env, L44594: ...process.platform !== "win32" && { ... L44598: } : undefined; L44599: const child = spawn(exe, args, { L44600: detached: true, ... L44606: sleep(ms) { L44607: return new Promise((resolve4) => setTimeout(resolve4, ms)); L44608: },

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/tool.jsView on unpkg · L44592

•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration. dist/tool.js: InvalidBaseUrlError: () => InvalidBaseUrlError, async writeFile(filePath, data) { await fs62.writeFile(filePath, data); await fs62.writeFile(lockFile, ownerId, { flag: "wx" }); await this.writeFile(destEntry, content); throw new Error("No authorization code received"); await fs72.writeFile(tempPath, JSON.stringify(state)); baseUrl: credentials.UIPATH_URL,

High

Credential Redirect Persistence

Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.

dist/tool.jsView on unpkg

dist/index.jsView file

38Cross-file remote execution chain: dist/index.js spawns dist/tool.js; helper contains network access plus dynamic code execution. L38: class CommanderError extends Error { L39: constructor(exitCode, code, message) { L40: super(message); ... L756: var EventEmitter = __require("node:events").EventEmitter; L757: var childProcess = __require("node:child_process"); L758: var path = __require("node:path"); ... L802: this._outputConfiguration = { L803: writeOut: (str) => process2.stdout.write(str), L804: writeErr: (str) => process2.stderr.write(str), ... L2153: function computeSafeTmpDir(real, linkPath) { L2154: if (process.platform === "win32" || real.length <= MAX_SAFE_TMPDIR_LEN) { L2155: return withTrailingSeparator(real);

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/index.jsView on unpkg · L38

Source & flagged code

8 flagged

dist/packager-tool.jsView file

Lines 1039-1079javascript

1039 }

1040 getProjectToolFactory(projectType) {

1041 const factory = this.projectFactoryMap.get(projectType);

1042 if (!factory) {

1043 throw new Error(`No tool factory found for project type '${projectType}'`);

1044 }

1045 return factory;

1046 }

1047 reset() {

1048 this.projectFactoryMap.clear();

1049 this.solutionFactory = null;

1050 }

1051}

1052var REGISTRY_KEY = Symbol.for("@uipath/solutionpackager-tool-core/toolsFactoryRepository");

1053var _global = globalThis;

1054if (!_global[REGISTRY_KEY]) {

1055 _global[REGISTRY_KEY] = new ToolsFactoryRepository;

1056}

1057var toolsFactoryRepository = _global[REGISTRY_KEY];

1058

1059// node_modules/@uipath/packager-tool-workflowcompiler/dist/index.js

1060import { execSync } from "node:child_process";

1061import { spawn } from "node:child_process";

High

Child Process

Package source references child process execution.

dist/packager-tool.jsView on unpkg · L1059

1062import { execFileSync } from "node:child_process";

1063import { homedir, platform } from "node:os";

1064var de_default = {

1065 toolWorkflowcompiler: {

1066 lifecycle: {

1067 started: "[WorkflowCompiler] {operation} started",

1068 command: "[WorkflowCompiler] Command: {command}",

1069 completed: "[WorkflowCompiler] {operation} completed in {elapsed}ms with code: {errorCode}",

1070 cancelled: "[WorkflowCompiler] Operation cancelled"

1071 },

1072 errors: {

1073 processExited: "Process exited with code {exitCode}",

1074 failed: "[WorkflowCompiler] {operation} failed: {errorMessage}",

1075 processError: "[WorkflowCompiler] Process error: {message}",

1076 startFailed: "Failed to start workflow compiler: {message}",

1077 operationCancelled: "Operation cancelled",

1078 dotnetNotAvailable: "The .NET SDK 8.0 is required by the workflow compiler, but the 'dotnet' CLI was not found on PATH. Install SDK 8.0 from https://dotnet.microsoft.com/download/dotnet/8.0, then re-run this command."

1079 },

Lines 3999-4039javascript

3999 getOptionValueSource(key) {

4000 return this._optionValueSources[key];

4001 }

4002 getOptionValueSourceWithGlobals(key) {

4003 let source;

4004 this._getCommandAndAncestors().forEach((cmd)

Lines 11880-11920javascript

11880 } : {}

11881 };

11882 return enriched;

11883 }

11884 generateId() {

11885 const bytes = new Uint8Array(8);

11886

•matchType = previous_version_dangerous_delta matchedPackage = @uipath/rpa-tool@1.199.0 matchedIdentity = npm:QHVpcGF0aC9ycGEtdG9vbA:1.199.0 similarity = 1.000 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/packager-tool.jsView on unpkg

•Manifest-reachable source resolves another installed package, overwrites its runtime code, and injects package-defined remote behavior. dist/packager-tool.js: // node_modules/@uipath/solutionpackager-tool-core/dist/index.js // node_modules/@uipath/packager-tool-workflowcompiler/dist/index.js dotnetNotAvailable: "The .NET SDK 8.0 is required by the workflow compiler, but the 'dotnet' CLI was not found on PATH. Install SDK 8.0 from https://dotnet.microsoft.com/download/d... dotnetNotAvailable: "The .NET SDK 8.0 is required by the workflow compiler, but the 'dotnet' CLI was not found on PATH. Install SDK 8.0 from https://dotnet.microsoft.com/download/d... dotnetNotAvailable: "The .NET SDK 8.0 is required by the workflow compiler, but the 'dotnet' CLI was not found on PATH. Install SDK 8.0 fro

High

Entrypoint Foreign Package Code Overwrite

Manifest-reachable source overwrites another installed package with package-defined remote behavior.

dist/packager-tool.jsView on unpkg

dist/tool.jsView file

44592const spawnEnv = needsCustomEnv ? { L44593: ...process.env, L44594: ...process.platform !== "win32" && { ... L44598: } : undefined; L44599: const child = spawn(exe, args, { L44600: detached: true, ... L44606: sleep(ms) { L44607: return new Promise((resolve4) => setTimeout(resolve4, ms)); L44608: },

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/tool.jsView on unpkg · L44592

•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration. dist/tool.js: InvalidBaseUrlError: () => InvalidBaseUrlError, async writeFile(filePath, data) { await fs62.writeFile(filePath, data); await fs62.writeFile(lockFile, ownerId, { flag: "wx" }); await this.writeFile(destEntry, content); throw new Error("No authorization code received"); await fs72.writeFile(tempPath, JSON.stringify(state)); baseUrl: credentials.UIPATH_URL,

High

Credential Redirect Persistence

Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.

dist/tool.jsView on unpkg

dist/index.jsView file

Lines 18-58javascript

18 if (cached)

19 return cached;

20 }

21 target = mod != null ? __create(__getProtoOf(mod)) : {};

22