registry / @uipath/rpa-tool / 1.203.1

@uipath/rpa-tool@1.203.1

Tool for creating and managing UiPath RPA projects

AI Security Review

scanned 17d ago · by lpm-firewall-ai

The inspected source supports ordinary UiPath CLI functionality, with local binary execution and session-aligned authentication. Scanner claims of an obscured gateway and downloaded payload execution were not substantiated by the reviewed code.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

Users invoke CLI commands or exported project-management functions; no automatic install hook is declared.

Impact

The inspected behavior enables expected project operations; no credential theft, unrelated payload execution, or agent-control mutation was established.

Mechanism

The code resolves local UiPath binaries, performs platform discovery, and authenticates cloud requests through the Studio session.

AI rationale

Decision evidence

public snapshot

AI called this Clean at 90.0% confidence as Benign with low false-positive risk.

Evidence for AI clean decision

package.json declares CLI and library entrypoints, platform-specific UiPath optional dependencies, and no install lifecycle hooks or runtime self-dependency.
dist/packager-tool.js encodes PowerShell commands as Base64; the inspected caller reads the default browser registry setting.
dist/tool.js obtains cloud destinations and authentication credentials from the same Studio session and sends authenticated requests to that destination.
dist/executor-tool.js resolves Helm from installed platform packages and launches the resolved local executable.
dist/index.js registers commands using CLI options and parses the user's arguments.

Evidence against

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsEvalFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

Manifest

NoLicense

Source & flagged code

8 flagged

dist/packager-tool.jsView file

Lines 1040-1080javascript

1040 }

1041 getProjectToolFactory(projectType) {

1042 const factory = this.projectFactoryMap.get(projectType);

1043 if (!factory) {

1044 throw new Error(`Cannot pack project type '${projectType}': no packager is installed for it.`);

1045 }

1046 return factory;

1047 }

1048 reset() {

1049 this.projectFactoryMap.clear();

1050 this.solutionFactory = null;

1051 }

1052}

1053var REGISTRY_KEY = Symbol.for("@uipath/solutionpackager-tool-core/toolsFactoryRepository");

1054var _global = globalThis;

1055if (!_global[REGISTRY_KEY]) {

1056 _global[REGISTRY_KEY] = new ToolsFactoryRepository;

1057}

1058var toolsFactoryRepository = _global[REGISTRY_KEY];

1059

1060// node_modules/@uipath/packager-tool-workflowcompiler/dist/index.js

1061import { execSync } from "node:child_process";

1062import { spawn } from "node:child_process";

High

Child Process

Package source references child process execution.

dist/packager-tool.jsView on unpkg · L1060

1063import { execFileSync } from "node:child_process";

1064import { homedir, platform } from "node:os";

1065var de_default = {

1066 toolWorkflowcompiler: {

1067 lifecycle: {

1068 started: "[WorkflowCompiler] {operation} started",

1069 command: "[WorkflowCompiler] Command: {command}",

1070 completed: "[WorkflowCompiler] {operation} completed in {elapsed}ms with code: {errorCode}",

1071 cancelled: "[WorkflowCompiler] Operation cancelled"

1072 },

1073 errors: {

1074 processExited: "Process exited with code {exitCode}",

1075 failed: "[WorkflowCompiler] {operation} failed: {errorMessage}",

1076 processError: "[WorkflowCompiler] Process error: {message}",

1077 startFailed: "Failed to start workflow compiler: {message}",

1078 operationCancelled: "Operation cancelled",

1079 dotnetNotAvailable: "The .NET SDK 8.0 is required by the workflow compiler, but the 'dotnet' CLI was not found on PATH. Install SDK 8.0 from https://dotnet.microsoft.com/download/dotnet/8.0, then re-run this command."

1080 },

Lines 3280-3320javascript

3280 if (isInsideContainer()) {

3281 return false;

3282 }

3283 return true;

3284 }

3285 try {

3286 if (fs3.

Lines 12961-13001javascript

12961}

12962function invocationElapsedMs() {

12963 return performance.now() - getState().baseline;

12964}

12965function markCommandStart() {

12966 if (!timingsEnabled

dist/tool.jsView file

47446const spawnEnv = needsCustomEnv ? { L47447: ...process.env, L47448: ...process.platform !== "win32" && { ... L47452: } : undefined; L47453: const child = spawn(exe, args, { L47454: detached: true, ... L47460: sleep(ms) { L47461: return new Promise((resolve4) => setTimeout(resolve4, ms)); L47462: },

Critical

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution with blocking evidence.

dist/tool.jsView on unpkg · L47446

61Trigger-reachable chain: manifest.main -> dist/tool.js L61: class CommanderError2 extends Error { L62: constructor(exitCode, code, message) { L63: super(message); ... L779: var EventEmitter = __require("node:events").EventEmitter; L780: var childProcess4 = __require("node:child_process"); L781: var path3 = __require("node:path"); ... L825: this._outputConfiguration = { L826: writeOut: (str2) => process9.stdout.write(str2), L827: writeErr: (str2) => process9.stderr.write(str2), ... L2454: tmpdir: os22.tmpdir, L2455: getenv: (key) => process.env[key] L2456: };

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/tool.jsView on unpkg · L61

•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration. dist/tool.js: InvalidBaseUrlError: () => InvalidBaseUrlError, async writeFile(filePath, data) { await fs62.writeFile(filePath, data); await fs62.writeFile(lockFile, ownerId, { flag: "wx" }); await this.writeFile(destEntry, content); throw new Error("No authorization code received"); await fs72.writeFile(tempPath, JSON.stringify(state)); baseUrl: credentials.UIPATH_URL,

dist/executor-tool.jsView file

89return e5[t4]; L90: } }, c = Object.getPrototypeOf(Function), l = typeof process == "object" && process.env && process.env.REFLECT_METADATA_USE_MAP_POLYFILL === "true", f = l || typeof Map != "functio... L91: var e5 = {}, t4 = [], r3 = function() { ... L6031: } L6032: isWebSocket(e3) { L6033: this._address = new o.NodeWebSocketAddress(e3); ... L6135: e3.current = function() { L6136: switch (process.platform === "win32" ? t3.Windows : t3.Linux) { L6137: case t3.Windows: ... L6293: return yield new Promise((t4, r2) => { L6294: this._socketLike.write(e3, (e4) => e4 ? r2(e4) : t4()); L6295: });

Critical

Download Execute

Source downloads or fetches remote code and executes it.

dist/executor-tool.jsView on unpkg · L89

dist/index.jsView file

Lines 18-58javascript

18 if (cached)

19 return cached;

20 }

21 target = mod != null ? __create(__getProtoOf(mod)) : {};

Source & flagged code

8 flagged · loading source

dist/packager-tool.jsView file

1060// node_modules/@uipath/packager-tool-workflowcompiler/dist/index.js L1061: import { execSync } from "node:child_process"; L1062: import { spawn } from "node:child_process";

High

Child Process

Package source references child process execution.

dist/packager-tool.jsView on unpkg · L1060

3300var execFile; L3301: var powerShellPath = () => `${process3.env.SYSTEMROOT || process3.env.windir || String.raw`C:\Windows`}\\System32\\WindowsPowerShell\\v1.0\\powershell.exe`; L3302: var executePowerShell = async (command, options = {}) => {

High

Shell

Package source references shell execution.

dist/packager-tool.jsView on unpkg · L3300

12981var telemetryInstanceSlot = singleton3("TelemetryService"); L12982: var DEFAULT_AI_CONNECTION_STRING = atob("[redacted]... L12983: function getGlobalTelemetryInstance() {

High

Base64 Obscured Url

Source decodes a Base64-obscured HTTP endpoint at runtime.

dist/packager-tool.jsView on unpkg · L12981

Findings

3 Critical5 High3 Medium6 Low

CriticalSame File Env Network Executiondist/tool.js

CriticalDownload Executedist/executor-tool.js

CriticalTrigger Reachable Dangerous Capabilitydist/tool.js

HighChild Processdist/packager-tool.js

HighShelldist/packager-tool.js

HighCredential Redirect Persistencedist/tool.js

HighCross File Remote Execution Contextdist/index.js

HighBase64 Obscured Urldist/packager-tool.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowEval

LowFilesystem

Affected versions and remediation

This report applies to @uipath/rpa-tool@1.203.1.

See all versions of @uipath/rpa-tool for other recorded verdicts.

Review the evidence and your use of @uipath/rpa-tool@1.203.1 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-10-06 20:54:41.481Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Related packages

More from @uipath

Behavioral surface

Related packages

More from @uipath

Source & flagged code