registry / @uipath/rpa-tool / 1.203.2

@uipath/rpa-tool@1.203.2

Tool for creating and managing UiPath RPA projects

AI Security Review

scanned 9d ago · by lpm-firewall-ai

The manifest has no install lifecycle hook, and inspection of the flagged runtime files did not establish a concrete attack chain. The scanner’s execution and network indicators resolve to package tooling and UiPath authentication behavior.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

A user invokes the CLI or uses an exported tool.

Impact

No package-controlled credential recipient, install-time action, persistence, or remote payload execution was established.

Mechanism

The package processes CLI arguments, authenticates against a configured UiPath authority, and includes a PowerShell command helper.

AI rationale

Network endpoints1

cloud.uipath.com

Decision evidence

public snapshot

AI called this Clean at 92.0% confidence as Benign with low false-positive risk.

Evidence for AI clean decision

The manifest points to CLI and tool entrypoints; its scripts are build, packaging, documentation, release, test, and lint tasks, with no install lifecycle hook.
Opaque UiPath tokens use UIPATH_URL as their authority, which the source normalizes and validates before returning it as the token’s base URL.
The CLI entrypoint parses the user’s command-line arguments and then shuts down telemetry.
The PowerShell helper constructs an encoded-command invocation using PowerShell command-line options.
The executor’s default authentication authority is UiPath Cloud.

Evidence against

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsEvalFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

Manifest

NoLicense

scanned 4 file(s), 4.39 MB of source, external domains: alpha.uipath.com, api.nuget.org, cloud.uipath.com, dotnet.microsoft.com, fonts.googleapis.com, fonts.gstatic.com, github.com, govcloud.uipath.us, npm.pkg.github.com, pkgs.uipath.com, purl.org, schemas.microsoft.com, schemas.openxmlformats.org, www.w3.org

Source & flagged code

8 flagged

dist/packager-tool.jsView file

Lines 1040-1080javascript

1040 }

1041 getProjectToolFactory(projectType) {

1042 const factory = this.projectFactoryMap.get(projectType);

1043 if (!factory) {

1044 throw new Error(`Cannot pack project type '${projectType}': no packager is installed for it.`);

1045 }

1046 return factory;

1047 }

1048 reset() {

1049 this.projectFactoryMap.clear();

1050 this.solutionFactory = null;

1051 }

1052}

1053var REGISTRY_KEY = Symbol.for("@uipath/solutionpackager-tool-core/toolsFactoryRepository");

1054var _global = globalThis;

1055if (!_global[REGISTRY_KEY]) {

1056 _global[REGISTRY_KEY] = new ToolsFactoryRepository;

1057}

1058var toolsFactoryRepository = _global[REGISTRY_KEY];

1059

1060// node_modules/@uipath/packager-tool-workflowcompiler/dist/index.js

1061import { execSync } from "node:child_process";

1062import { spawn } from "node:child_process";

High

Child Process

Package source references child process execution.

dist/packager-tool.jsView on unpkg · L1060

1063import { execFileSync } from "node:child_process";

1064import { homedir, platform } from "node:os";

1065var de_default = {

1066 toolWorkflowcompiler: {

1067 lifecycle: {

1068 started: "[WorkflowCompiler] {operation} started",

1069 command: "[WorkflowCompiler] Command: {command}",

1070 completed: "[WorkflowCompiler] {operation} completed in {elapsed}ms with code: {errorCode}",

1071 cancelled: "[WorkflowCompiler] Operation cancelled"

1072 },

1073 errors: {

1074 processExited: "Process exited with code {exitCode}",

1075 failed: "[WorkflowCompiler] {operation} failed: {errorMessage}",

1076 processError: "[WorkflowCompiler] Process error: {message}",

1077 startFailed: "Failed to start workflow compiler: {message}",

1078 operationCancelled: "Operation cancelled",

1079 dotnetNotAvailable: "The .NET SDK 8.0 is required by the workflow compiler, but the 'dotnet' CLI was not found on PATH. Install SDK 8.0 from https://dotnet.microsoft.com/download/dotnet/8.0, then re-run this command."

1080 },

Lines 3280-3320javascript

3280 if (isInsideContainer()) {

3281 return false;

3282 }

3283 return true;

3284 }

3285 try {

3286 if (fs3.

Lines 12961-13001javascript

12961}

12962function invocationElapsedMs() {

12963 return performance.now() - getState().baseline;

12964}

12965function markCommandStart() {

12966 if (!timingsEnabled

dist/tool.jsView file

47446const spawnEnv = needsCustomEnv ? { L47447: ...process.env, L47448: ...process.platform !== "win32" && { ... L47452: } : undefined; L47453: const child = spawn(exe, args, { L47454: detached: true, ... L47460: sleep(ms) { L47461: return new Promise((resolve4) => setTimeout(resolve4, ms)); L47462: },

Critical

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution with blocking evidence.

dist/tool.jsView on unpkg · L47446

61Trigger-reachable chain: manifest.main -> dist/tool.js L61: class CommanderError2 extends Error { L62: constructor(exitCode, code, message) { L63: super(message); ... L779: var EventEmitter = __require("node:events").EventEmitter; L780: var childProcess4 = __require("node:child_process"); L781: var path3 = __require("node:path"); ... L825: this._outputConfiguration = { L826: writeOut: (str2) => process9.stdout.write(str2), L827: writeErr: (str2) => process9.stderr.write(str2), ... L2454: tmpdir: os22.tmpdir, L2455: getenv: (key) => process.env[key] L2456: };

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/tool.jsView on unpkg · L61

•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration. dist/tool.js: InvalidBaseUrlError: () => InvalidBaseUrlError, async writeFile(filePath, data) { await fs62.writeFile(filePath, data); await fs62.writeFile(lockFile, ownerId, { flag: "wx" }); await this.writeFile(destEntry, content); throw new Error("No authorization code received"); await fs72.writeFile(tempPath, JSON.stringify(state)); baseUrl: credentials.UIPATH_URL,

dist/executor-tool.jsView file

89return e5[t4]; L90: } }, c = Object.getPrototypeOf(Function), l = typeof process == "object" && process.env && process.env.REFLECT_METADATA_USE_MAP_POLYFILL === "true", f = l || typeof Map != "functio... L91: var e5 = {}, t4 = [], r3 = function() { ... L6031: } L6032: isWebSocket(e3) { L6033: this._address = new o.NodeWebSocketAddress(e3); ... L6135: e3.current = function() { L6136: switch (process.platform === "win32" ? t3.Windows : t3.Linux) { L6137: case t3.Windows: ... L6293: return yield new Promise((t4, r2) => { L6294: this._socketLike.write(e3, (e4) => e4 ? r2(e4) : t4()); L6295: });

Critical

Download Execute

Source downloads or fetches remote code and executes it.

dist/executor-tool.jsView on unpkg · L89

dist/index.jsView file

Lines 18-58javascript

18 if (cached)

19 return cached;

20 }

21 target = mod != null ? __create(__getProtoOf(mod)) : {};

Source & flagged code

8 flagged · loading source

dist/packager-tool.jsView file

1060// node_modules/@uipath/packager-tool-workflowcompiler/dist/index.js L1061: import { execSync } from "node:child_process"; L1062: import { spawn } from "node:child_process";

High

Child Process

Package source references child process execution.

dist/packager-tool.jsView on unpkg · L1060

3300var execFile; L3301: var powerShellPath = () => `${process3.env.SYSTEMROOT || process3.env.windir || String.raw`C:\Windows`}\\System32\\WindowsPowerShell\\v1.0\\powershell.exe`; L3302: var executePowerShell = async (command, options = {}) => {

High

Shell

Package source references shell execution.

dist/packager-tool.jsView on unpkg · L3300

12981var telemetryInstanceSlot = singleton3("TelemetryService"); L12982: var DEFAULT_AI_CONNECTION_STRING = atob("[redacted]... L12983: function getGlobalTelemetryInstance() {

High

Base64 Obscured Url

Source decodes a Base64-obscured HTTP endpoint at runtime.

dist/packager-tool.jsView on unpkg · L12981

Findings

3 Critical5 High3 Medium6 Low

CriticalSame File Env Network Executiondist/tool.js

CriticalDownload Executedist/executor-tool.js

CriticalTrigger Reachable Dangerous Capabilitydist/tool.js

HighChild Processdist/packager-tool.js

HighShelldist/packager-tool.js

HighCredential Redirect Persistencedist/tool.js

HighCross File Remote Execution Contextdist/index.js

HighBase64 Obscured Urldist/packager-tool.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowEval

LowFilesystem

Affected versions and remediation

This report applies to @uipath/rpa-tool@1.203.2.

See all versions of @uipath/rpa-tool for other recorded verdicts.

Review the evidence and your use of @uipath/rpa-tool@1.203.2 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-10-14 11:57:33.682Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Related packages

More from @uipath

Behavioral surface

Related packages

More from @uipath

Source & flagged code