registry / @uipath/solution-packager / 1.201.0
@uipath/solution-packager@1.201.0
UiPath Solution Packager - core library for packing UiPath solutions
AI Security Review
scanned 2mo ago · by lpm-firewall-aiThe package is a library with no lifecycle scripts. Its network and file operations are explicit solution-packaging functions, with no evidence of covert collection, persistence, or execution.
Static reason
No blocking static signals were detected.
Trigger
A caller explicitly invokes setupWithUrlAsync with a download URL.
Impact
The supplied token is sent only to the supplied download URL.
Mechanism
Downloads solution input for packaging.
AI rationale
The package is a library with no lifecycle scripts. Its network and file operations are explicit solution-packaging functions, with no evidence of covert collection, persistence, or execution.
Decision evidence
public snapshotAI called this Clean at 94.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The exported packager has a user-invoked method that fetches a caller-supplied URL and can attach a supplied bearer token.
- The manifest exposes library entry points and declares no lifecycle scripts.
Evidence against
- No install-time execution, shell execution, dynamic evaluation, environment harvesting, or hard-coded network endpoint was found.
- The fetched content is passed to solution setup as zip input; the source does not send local data to that URL.
- File writes create the requested solution archive and package metadata.
Behavioral surface
FilesystemNetwork
HighEntropyStrings
Source & flagged code
2 flagged · loading sourcedist/index.jsView file
1165async setupWithUrlAsync(downloadUrl, accessToken, operationId) {
const headers = {};
if (accessToken) {
headers.Authorization = `Bearer ${accessToken}`;
}
const response = await fetch(downloadUrl, { headers });
if (!response.ok) {
throw new Error(`Failed to download solution: ${response.status} ${response.statusText}`);
}
const arrayBuffer = await response.arrayBuffer();
const zipData = new Uint8Array(arrayBuffer);
Low
Ai Review Evidence
The exported packager has a user-invoked method that fetches a caller-supplied URL and can attach a supplied bearer token.
dist/index.jsView on unpkg · L1165package.jsonView file
2"name": "@uipath/solution-packager",
"license": "MIT",
"version": "1.201.0",
"description": "UiPath Solution Packager - core library for packing UiPath solutions",
"type": "module",
"main": "./dist/index.js",
"exports": {
".": {
"types": "./dist/src/index.d.ts",
"default": "./dist/index.js"
},
"./node": {
"types": "./dist/src/node.d.ts",
"default": "./dist/node.js"
}
}
Low
Suspicious Lifecycle Evidence
The manifest exposes library entry points and declares no lifecycle scripts.
package.jsonView on unpkg · L2Findings
1 Medium4 Low
MediumNetwork
LowFilesystem
LowHigh Entropy Strings
LowAi Review Evidencedist/index.js
LowSuspicious Lifecycle Evidencepackage.json
Affected versions and remediation
This report applies to @uipath/solution-packager@1.201.0.
See all versions of @uipath/solution-packager for other recorded verdicts.
- Review the evidence and your use of @uipath/solution-packager@1.201.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.