registry / Remote code execution / @uipath/rpa-tool / 1.202.0

@uipath/rpa-tool@1.202.0

Tool for creating and managing UiPath RPA projects

AI Security Review

scanned 1mo ago · by lpm-firewall-ai

Inspected source is a vendor UiPath RPA CLI with no install lifecycle hooks; network, auth, and process execution match pack, execute, and login flows. The dist bundles are too large to fully verify, so dual-use spawn and NuGet restore stay at warn rather than clean or block.

Static reason

High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source

Trigger

The user runs the rpa-tool command or imports dist/tool.js, dist/packager-tool.js, or dist/executor-tool.js. There is no npm preinstall, install, or postinstall hook.

Impact

Local compiler, Helm, or Studio binaries can start, and UiPath auth files can be written under the user home directory when the user logs in.

Mechanism

User-invoked RPA toolchain with NuGet restore, detached process spawn, and vendor OIDC token storage

AI rationale

Evidence

package.jsondist/index.jsdist/tool.jsdist/packager-tool.jsdist/executor-tool.js.uipath/.auth

Network endpoints4

pkgs.uipath.com/internal/index.jsonapi.nuget.org/v3/index.jsoncloud.uipath.comgovcloud.uipath.us

Decision evidence

public snapshot

AI called this Suspicious at 74.0% confidence as Dangerous Capability with medium false-positive risk.

Evidence for warning

User-invoked CLI and module entrypoints load large bundled tools that combine environment access, network calls, and process execution, with no npm install hook.
The packager restores UiPath.WorkflowCompiler from pkgs.uipath.com and api.nuget.org, then spawns that compiler.
The executor and main tool spawn detached Studio or Helm binaries and persist OIDC auth files under the user home .uipath directory.
Published dist bundles are tens of thousands of lines, so extra hidden behavior cannot be fully ruled out by this review.

Evidence against

package.json has no preinstall, install, or postinstall scripts; only build, test, lint, and version bump scripts.
Hosts in source are UiPath, NuGet, Microsoft, GitHub, and Google Fonts, matching a UiPath RPA CLI.
Process spawn is used to run the workflow compiler, Helm, and Studio after explicit CLI use, not at install time.
Default login base URL is cloud.uipath.com with a localhost OIDC callback, not a third-party credential sink.

Behavioral surface

Source

ChildProcess

Source & flagged code

9 flagged

dist/packager-tool.jsView file

Lines 1040-1080javascript

1040 }

1041 getProjectToolFactory(projectType) {

1042 const factory = this.projectFactoryMap.get(projectType);

1043 if (!factory) {

1044 throw new Error(`Cannot pack project type '${projectType}': no packager is installed for it.`);

1045 }

1046 return factory;

1047 }

1048 reset() {

1049 this.projectFactoryMap.clear();

1050 this.solutionFactory = null;

1051 }

1052}

1053var REGISTRY_KEY = Symbol.for("@uipath/solutionpackager-tool-core/toolsFactoryRepository");

1054var _global = globalThis;

1055if (!_global[REGISTRY_KEY]) {

1056 _global[REGISTRY_KEY] = new ToolsFactoryRepository;

1057}

1058var toolsFactoryRepository = _global[REGISTRY_KEY];

1059

1060// node_modules/@uipath/packager-tool-workflowcompiler/dist/index.js

1061import { execSync } from "node:child_process";

1062import { spawn } from "node:child_process";

High

Child Process

Package source references child process execution.

dist/packager-tool.jsView on unpkg · L1060

1063import { execFileSync } from "node:child_process";

1064import { homedir, platform } from "node:os";

1065var de_default = {

1066 toolWorkflowcompiler: {

1067 lifecycle: {

1068 started: "[WorkflowCompiler] {operation} started",

1069 command: "[WorkflowCompiler] Command: {command}",

1070 completed: "[WorkflowCompiler] {operation} completed in {elapsed}ms with code: {errorCode}",

1071 cancelled: "[WorkflowCompiler] Operation cancelled"

1072 },

1073 errors: {

1074 processExited: "Process exited with code {exitCode}",

1075 failed: "[WorkflowCompiler] {operation} failed: {errorMessage}",

1076 processError: "[WorkflowCompiler] Process error: {message}",

1077 startFailed: "Failed to start workflow compiler: {message}",

1078 operationCancelled: "Operation cancelled",

1079 dotnetNotAvailable: "The .NET SDK 8.0 is required by the workflow compiler, but the 'dotnet' CLI was not found on PATH. Install SDK 8.0 from https://dotnet.microsoft.com/download/dotnet/8.0, then re-run this command."

1080 },

Lines 3280-3320javascript

3280 if (isInsideContainer()) {

3281 return false;

3282 }

3283 return true;

3284 }

3285 try {

3286 if (fs3.

Lines 12961-13001javascript

12961}

12962function invocationElapsedMs() {

12963 return performance.now() - getState().baseline;

12964}

12965function markCommandStart() {

12966 if (!timingsEnabled

•matchType = previous_version_dangerous_delta matchedPackage = @uipath/rpa-tool@1.201.0 matchedIdentity = npm:QHVpcGF0aC9ycGEtdG9vbA:1.201.0 similarity = 0.750 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/packager-tool.jsView on unpkg

dist/tool.jsView file

46776const spawnEnv = needsCustomEnv ? { L46777: ...process.env, L46778: ...process.platform !== "win32" && { ... L46782: } : undefined; L46783: const child = spawn(exe, args, { L46784: detached: true, ... L46790: sleep(ms) { L46791: return new Promise((resolve4) => setTimeout(resolve4, ms)); L46792: },

Critical

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution with blocking evidence.

dist/tool.jsView on unpkg · L46776

61Trigger-reachable chain: manifest.main -> dist/tool.js L61: class CommanderError2 extends Error { L62: constructor(exitCode, code, message) { L63: super(message); ... L779: var EventEmitter = __require("node:events").EventEmitter; L780: var childProcess4 = __require("node:child_process"); L781: var path3 = __require("node:path"); ... L825: this._outputConfiguration = { L826: writeOut: (str2) => process9.stdout.write(str2), L827: writeErr: (str2) => process9.stderr.write(str2), ... L2448: tmpdir: os22.tmpdir, L2449: getenv: (key) => process.env[key] L2450: };

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/tool.jsView on unpkg · L61

•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration. dist/tool.js: InvalidBaseUrlError: () => InvalidBaseUrlError, async writeFile(filePath, data) { await fs62.writeFile(filePath, data); await fs62.writeFile(lockFile, ownerId, { flag: "wx" }); await this.writeFile(destEntry, content); throw new Error("No authorization code received"); await fs72.writeFile(tempPath, JSON.stringify(state)); baseUrl: credentials.UIPATH_URL,

dist/executor-tool.jsView file

89return e5[t4]; L90: } }, c = Object.getPrototypeOf(Function), l = typeof process == "object" && process.env && process.env.REFLECT_METADATA_USE_MAP_POLYFILL === "true", f = l || typeof Map != "functio... L91: var e5 = {}, t4 = [], r3 = function() { ... L6031: } L6032: isWebSocket(e3) { L6033: this._address = new o.NodeWebSocketAddress(e3); ... L6135: e3.current = function() { L6136: switch (process.platform === "win32" ? t3.Windows : t3.Linux) { L6137: case t3.Windows: ... L6293: return yield new Promise((t4, r2) => { L6294: this._socketLike.write(e3, (e4) => e4 ? r2(e4) : t4()); L6295: });

Critical

Download Execute

Source downloads or fetches remote code and executes it.

dist/executor-tool.jsView on unpkg · L89

dist/index.jsView file

Lines 18-58javascript

18 if (cached)

19 return cached;

20 }

21 target = mod != null ? __create(__getProtoOf(mod)) : {};

Source & flagged code

9 flagged · loading source

dist/packager-tool.jsView file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/packager-tool.jsView on unpkg

1060// node_modules/@uipath/packager-tool-workflowcompiler/dist/index.js L1061: import { execSync } from "node:child_process"; L1062: import { spawn } from "node:child_process";

High

Child Process

Package source references child process execution.

dist/packager-tool.jsView on unpkg · L1060

3300var execFile; L3301: var powerShellPath = () => `${process3.env.SYSTEMROOT || process3.env.windir || String.raw`C:\Windows`}\\System32\\WindowsPowerShell\\v1.0\\powershell.exe`; L3302: var executePowerShell = async (command, options = {}) => {

High

Shell

Package source references shell execution.

dist/packager-tool.jsView on unpkg · L3300

Findings

4 Critical5 High3 Medium5 Low

CriticalSame File Env Network Executiondist/tool.js

CriticalDownload Executedist/executor-tool.js

CriticalTrigger Reachable Dangerous Capabilitydist/tool.js

CriticalPrevious Version Dangerous Deltadist/packager-tool.js

HighChild Processdist/packager-tool.js

HighShelldist/packager-tool.js

HighCredential Redirect Persistencedist/tool.js

HighCross File Remote Execution Contextdist/index.js

HighBase64 Obscured Urldist/packager-tool.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

Affected versions and remediation

This report applies to @uipath/rpa-tool@1.202.0.

See all versions of @uipath/rpa-tool for other recorded verdicts.

Review the evidence and your use of @uipath/rpa-tool@1.202.0 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-09-16 18:05:07.002Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Related packages

More from @uipath

Behavioral surface

Related packages

More from @uipath

Source & flagged code