registry / @uipath/rpa-tool / 1.202.1

@uipath/rpa-tool@1.202.1

Tool for creating and managing UiPath RPA projects

AI Security Review

scanned 1mo ago · by lpm-firewall-ai

Static review of package.json and the bundled dist entrypoints shows an official UiPath RPA CLI with no install hooks and no credential or payload send to an unrelated host. Scanner critical hits are expected dual-use behavior in a bun-bundled packager, executor, and OIDC login client.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

A user installs the package and later runs the rpa-tool command or calls the exported packager or executor factories.

Impact

No confirmed malicious attack surface beyond the intended local automation and UiPath service calls.

Mechanism

First-party RPA pack, execute, and login toolchain

AI rationale

Decision evidence

public snapshot

AI called this Clean at 88.0% confidence as Benign with low false-positive risk.

Evidence for AI clean decision

package.json describes a UiPath RPA CLI with dist entrypoints and no preinstall, install, or postinstall scripts.
dist/index.js is a commander CLI that registers commands and then parses process.argv.
dist/packager-tool.js probes dotnet --version and spawns the workflow compiler with shell disabled; the module only exports registerPackagerFactories.
dist/tool.js OIDC login validates an https authority and posts the code exchange to {baseUrl}/identity_/connect/token, defaulting to cloud.uipath.com.
dist/executor-tool.js DownloadFile and ExecuteProcess are CoreIPC proxy stubs; Helm is resolved from optional @uipath/studio-helm packages.
Scanner env, network, and process hits come from one bun-bundled first-party RPA toolchain, not a hidden install payload.

Evidence against

No unofficial gateway, no credential send to an unrelated host, and no foreign AI-agent config writes.
The Base64 atob string is an Application Insights connection string used as DEFAULT_AI_CONNECTION_STRING.
Helm, NuGet, and compiler process use run when the operator invokes rpa-tool, not at npm install.
MCP command registration wraps Studio tools for the CLI rather than mutating another agent's config on install.

Source & flagged code

8 flagged

dist/packager-tool.jsView file

Lines 1040-1080javascript

1040 }

1041 getProjectToolFactory(projectType) {

1042 const factory = this.projectFactoryMap.get(projectType);

1043 if (!factory) {

1044 throw new Error(`Cannot pack project type '${projectType}': no packager is installed for it.`);

1045 }

1046 return factory;

1047 }

1048 reset() {

1049 this.projectFactoryMap.clear();

1050 this.solutionFactory = null;

1051 }

1052}

1053var REGISTRY_KEY = Symbol.for("@uipath/solutionpackager-tool-core/toolsFactoryRepository");

1054var _global = globalThis;

1055if (!_global[REGISTRY_KEY]) {

1056 _global[REGISTRY_KEY] = new ToolsFactoryRepository;

1057}

1058var toolsFactoryRepository = _global[REGISTRY_KEY];

1059

1060// node_modules/@uipath/packager-tool-workflowcompiler/dist/index.js

1061import { execSync } from "node:child_process";

1062import { spawn } from "node:child_process";

High

Child Process

Package source references child process execution.

dist/packager-tool.jsView on unpkg · L1060

1063import { execFileSync } from "node:child_process";

1064import { homedir, platform } from "node:os";

1065var de_default = {

1066 toolWorkflowcompiler: {

1067 lifecycle: {

1068 started: "[WorkflowCompiler] {operation} started",

1069 command: "[WorkflowCompiler] Command: {command}",

1070 completed: "[WorkflowCompiler] {operation} completed in {elapsed}ms with code: {errorCode}",

1071 cancelled: "[WorkflowCompiler] Operation cancelled"

1072 },

1073 errors: {

1074 processExited: "Process exited with code {exitCode}",

1075 failed: "[WorkflowCompiler] {operation} failed: {errorMessage}",

1076 processError: "[WorkflowCompiler] Process error: {message}",

1077 startFailed: "Failed to start workflow compiler: {message}",

1078 operationCancelled: "Operation cancelled",

1079 dotnetNotAvailable: "The .NET SDK 8.0 is required by the workflow compiler, but the 'dotnet' CLI was not found on PATH. Install SDK 8.0 from https://dotnet.microsoft.com/download/dotnet/8.0, then re-run this command."

1080 },

Lines 3280-3320javascript

3280 if (isInsideContainer()) {

3281 return false;

3282 }

3283 return true;

3284 }

3285 try {

3286 if (fs3.

Lines 12961-13001javascript

12961}

12962function invocationElapsedMs() {

12963 return performance.now() - getState().baseline;

12964}

12965function markCommandStart() {

12966 if (!timingsEnabled

dist/tool.jsView file

46776const spawnEnv = needsCustomEnv ? { L46777: ...process.env, L46778: ...process.platform !== "win32" && { ... L46782: } : undefined; L46783: const child = spawn(exe, args, { L46784: detached: true, ... L46790: sleep(ms) { L46791: return new Promise((resolve4) => setTimeout(resolve4, ms)); L46792: },

Critical

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution with blocking evidence.

dist/tool.jsView on unpkg · L46776

61Trigger-reachable chain: manifest.main -> dist/tool.js L61: class CommanderError2 extends Error { L62: constructor(exitCode, code, message) { L63: super(message); ... L779: var EventEmitter = __require("node:events").EventEmitter; L780: var childProcess4 = __require("node:child_process"); L781: var path3 = __require("node:path"); ... L825: this._outputConfiguration = { L826: writeOut: (str2) => process9.stdout.write(str2), L827: writeErr: (str2) => process9.stderr.write(str2), ... L2448: tmpdir: os22.tmpdir, L2449: getenv: (key) => process.env[key] L2450: };

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/tool.jsView on unpkg · L61

•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration. dist/tool.js: InvalidBaseUrlError: () => InvalidBaseUrlError, async writeFile(filePath, data) { await fs62.writeFile(filePath, data); await fs62.writeFile(lockFile, ownerId, { flag: "wx" }); await this.writeFile(destEntry, content); throw new Error("No authorization code received"); await fs72.writeFile(tempPath, JSON.stringify(state)); baseUrl: credentials.UIPATH_URL,

dist/executor-tool.jsView file

89return e5[t4]; L90: } }, c = Object.getPrototypeOf(Function), l = typeof process == "object" && process.env && process.env.REFLECT_METADATA_USE_MAP_POLYFILL === "true", f = l || typeof Map != "functio... L91: var e5 = {}, t4 = [], r3 = function() { ... L6031: } L6032: isWebSocket(e3) { L6033: this._address = new o.NodeWebSocketAddress(e3); ... L6135: e3.current = function() { L6136: switch (process.platform === "win32" ? t3.Windows : t3.Linux) { L6137: case t3.Windows: ... L6293: return yield new Promise((t4, r2) => { L6294: this._socketLike.write(e3, (e4) => e4 ? r2(e4) : t4()); L6295: });

Critical

Download Execute

Source downloads or fetches remote code and executes it.

dist/executor-tool.jsView on unpkg · L89

dist/index.jsView file

Lines 18-58javascript

18 if (cached)

19 return cached;

20 }

21 target = mod != null ? __create(__getProtoOf(mod)) : {};

Source & flagged code

8 flagged · loading source

dist/packager-tool.jsView file

1060// node_modules/@uipath/packager-tool-workflowcompiler/dist/index.js L1061: import { execSync } from "node:child_process"; L1062: import { spawn } from "node:child_process";

High

Child Process

Package source references child process execution.

dist/packager-tool.jsView on unpkg · L1060

3300var execFile; L3301: var powerShellPath = () => `${process3.env.SYSTEMROOT || process3.env.windir || String.raw`C:\Windows`}\\System32\\WindowsPowerShell\\v1.0\\powershell.exe`; L3302: var executePowerShell = async (command, options = {}) => {

High

Shell

Package source references shell execution.

dist/packager-tool.jsView on unpkg · L3300

12981var telemetryInstanceSlot = singleton3("TelemetryService"); L12982: var DEFAULT_AI_CONNECTION_STRING = atob("[redacted]... L12983: function getGlobalTelemetryInstance() {

High

Base64 Obscured Url

Source decodes a Base64-obscured HTTP endpoint at runtime.

dist/packager-tool.jsView on unpkg · L12981

Findings

3 Critical5 High3 Medium6 Low

CriticalSame File Env Network Executiondist/tool.js

CriticalDownload Executedist/executor-tool.js

CriticalTrigger Reachable Dangerous Capabilitydist/tool.js

HighChild Processdist/packager-tool.js

HighShelldist/packager-tool.js

HighCredential Redirect Persistencedist/tool.js

HighCross File Remote Execution Contextdist/index.js

HighBase64 Obscured Urldist/packager-tool.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowEval

LowFilesystem

Affected versions and remediation

This report applies to @uipath/rpa-tool@1.202.1.

See all versions of @uipath/rpa-tool for other recorded verdicts.

Review the evidence and your use of @uipath/rpa-tool@1.202.1 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-09-18 19:53:14.382Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Related packages

More from @uipath

Behavioral surface

Related packages

More from @uipath

Source & flagged code