@uipath/solution-tool@1.199.0: Clean npm security report (Allow) | LPM Firewall

Loading npm security reports…

@uipath/solution-tool@1.199.0: Clean npm security report (Allow) | LPM Firewall

Source & flagged code

8 flagged · loading source

dist/resource.jsView file

114import { promisify } from "node:util"; L115: import childProcess from "node:child_process"; L116: var execFile, powerShellPath = () => `${process3.env.SYSTEMROOT || process3.env.windir || String.raw`C:\Windows`}\\System32\\WindowsPowerShell\\v1.0\\powershell.exe`, executePowerS...

High

Child Process

Package source references child process execution.

dist/resource.jsView on unpkg · L114

110L111: // ../../node_modules/powershell-utils/index.js L112: import process3 from "node:process";

High

Shell

Package source references shell execution.

dist/resource.jsView on unpkg · L110

30125var telemetryInstanceSlot = singleton("TelemetryService"); L30126: var DEFAULT_AI_CONNECTION_STRING = atob("[redacted]... L30127: function getGlobalTelemetryInstance() {

High

Base64 Obscured Url

Source decodes a Base64-obscured HTTP endpoint at runtime.

dist/resource.jsView on unpkg · L30125

dist/deploy.jsView file

•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration. dist/deploy.js: async writeFile(filePath, data) { await fs6.writeFile(filePath, data); await fs6.writeFile(lockFile, ownerId, { flag: "wx" }); await this.writeFile(destEntry, content); (!t4 || e3._originalSecure && !l2) && (delete s2.headers.authorization, delete s2.headers.cookie, t4 || delete s2.headers.host, s2.auth = undefined); s2.auth && !n2.headers.authorization && (n2.headers.authorization = "Basic " + Buffer.from(s2.auth).toString("base64")), O2 = e3._req = _2(s2), e3._redirects && e3.emit("redirect",... function readLineBreak(state) { readLineBreak(state);

High

Credential Redirect Persistence

Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.

dist/deploy.jsView on unpkg

110L111: // ../../node_modules/powershell-utils/index.js L112: import process3 from "node:process"; ... L138: ]; L139: executePowerShell.encodeCommand = (command) => Buffer2.from(command, "utf16le").toString("base64"); L140: executePowerShell.escapeArgument = (value) => `'${String(value).replaceAll("'", "''")}'`; ... L178: const command = String.raw`(Get-ItemProperty -Path "HKCU:\Software\Microsoft\Windows\Shell\Associations\UrlAssociations\http\UserChoice").ProgId`; L179: const { stdout } = await executePowerShell(command, { powerShellPath: psPath }); L180: return stdout.trim(); ... L404: } L405: var fallbackAttemptSymbol, __dirname2, localXdgOpenPath, platform, arch, tryEachApp = async (apps, opener) => { L406: if (apps.length === 0) {

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/deploy.jsView on unpkg · L110

dist/packager-tool.jsView file

•Manifest-reachable source resolves another installed package, overwrites its runtime code, and injects package-defined remote behavior. dist/packager-tool.js: // ../../node_modules/fflate/esm/index.mjs await fs.writeFile(filePath, `${JSON.stringify(data, null, 2)} await this.fileSystem.writeFile(normalizedOutputPath, zippedData); await writeOrBackfillOperateProjectId(operateJsonFilePath, projectId, this.fileSystem, () => this.fileSystem.writeFile(operateJsonFilePath, JSON.stringify({ $schema: "https://cloud.uipath.com/draft/2024-12/operate", await this.fileSystem.writeFile(projectFilePath, `${JSON.stringify({ projectId: id }, null, 2)} $schema: "https://cloud.uipath.com/draft/2024-12/package-descriptor", await this.fileSystem.writeFile(packageDescriptorPath, JSON.stringify(descriptor, null

High

Entrypoint Foreign Package Code Overwrite

Manifest-reachable source overwrites another installed package with package-defined remote behavior.

dist/packager-tool.jsView on unpkg

dist/index.jsView file

39Cross-file remote execution chain: dist/index.js spawns dist/tool.js; helper contains network access plus dynamic code execution. L39: class CommanderError extends Error { L40: constructor(exitCode, code, message) { L41: super(message); ... L757: var EventEmitter = __require("node:events").EventEmitter; L758: var childProcess = __require("node:child_process"); L759: var path = __require("node:path"); ... L803: this._outputConfiguration = { L804: writeOut: (str) => process2.stdout.write(str), L805: writeErr: (str) => process2.stderr.write(str),

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/index.jsView on unpkg · L39

dist/pack.jsView file

•path = dist/pack.js kind = oversized_source_file sizeBytes = 17257493 magicHex = [redacted]

Medium

Oversized Source File

Package contains source files above the normal full-analysis size ceiling.

dist/pack.jsView on unpkg

Source & flagged code

8 flagged

dist/resource.jsView file

114import { promisify } from "node:util"; L115: import childProcess from "node:child_process"; L116: var execFile, powerShellPath = () => `${process3.env.SYSTEMROOT || process3.env.windir || String.raw`C:\Windows`}\\System32\\WindowsPowerShell\\v1.0\\powershell.exe`, executePowerS...

High

Child Process

Package source references child process execution.

dist/resource.jsView on unpkg · L114

110L111: // ../../node_modules/powershell-utils/index.js L112: import process3 from "node:process";

High

Shell

Package source references shell execution.

dist/resource.jsView on unpkg · L110

30125var telemetryInstanceSlot = singleton("TelemetryService"); L30126: var DEFAULT_AI_CONNECTION_STRING = atob("[redacted]... L30127: function getGlobalTelemetryInstance() {

High

Base64 Obscured Url

Source decodes a Base64-obscured HTTP endpoint at runtime.

dist/resource.jsView on unpkg · L30125

dist/deploy.jsView file

•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration. dist/deploy.js: async writeFile(filePath, data) { await fs6.writeFile(filePath, data); await fs6.writeFile(lockFile, ownerId, { flag: "wx" }); await this.writeFile(destEntry, content); (!t4 || e3._originalSecure && !l2) && (delete s2.headers.authorization, delete s2.headers.cookie, t4 || delete s2.headers.host, s2.auth = undefined); s2.auth && !n2.headers.authorization && (n2.headers.authorization = "Basic " + Buffer.from(s2.auth).toString("base64")), O2 = e3._req = _2(s2), e3._redirects && e3.emit("redirect",... function readLineBreak(state) { readLineBreak(state);

High

Credential Redirect Persistence

Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.

dist/deploy.jsView on unpkg

110L111: // ../../node_modules/powershell-utils/index.js L112: import process3 from "node:process"; ... L138: ]; L139: executePowerShell.encodeCommand = (command) => Buffer2.from(command, "utf16le").toString("base64"); L140: executePowerShell.escapeArgument = (value) => `'${String(value).replaceAll("'", "''")}'`; ... L178: const command = String.raw`(Get-ItemProperty -Path "HKCU:\Software\Microsoft\Windows\Shell\Associations\UrlAssociations\http\UserChoice").ProgId`; L179: const { stdout } = await executePowerShell(command, { powerShellPath: psPath }); L180: return stdout.trim(); ... L404: } L405: var fallbackAttemptSymbol, __dirname2, localXdgOpenPath, platform, arch, tryEachApp = async (apps, opener) => { L406: if (apps.length === 0) {

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/deploy.jsView on unpkg · L110

dist/packager-tool.jsView file

•Manifest-reachable source resolves another installed package, overwrites its runtime code, and injects package-defined remote behavior. dist/packager-tool.js: // ../../node_modules/fflate/esm/index.mjs await fs.writeFile(filePath, `${JSON.stringify(data, null, 2)} await this.fileSystem.writeFile(normalizedOutputPath, zippedData); await writeOrBackfillOperateProjectId(operateJsonFilePath, projectId, this.fileSystem, () => this.fileSystem.writeFile(operateJsonFilePath, JSON.stringify({ $schema: "https://cloud.uipath.com/draft/2024-12/operate", await this.fileSystem.writeFile(projectFilePath, `${JSON.stringify({ projectId: id }, null, 2)} $schema: "https://cloud.uipath.com/draft/2024-12/package-descriptor", await this.fileSystem.writeFile(packageDescriptorPath, JSON.stringify(descriptor, null

High

Entrypoint Foreign Package Code Overwrite

Manifest-reachable source overwrites another installed package with package-defined remote behavior.

dist/packager-tool.jsView on unpkg

dist/index.jsView file

Lines 19-59javascript

19 if (cached)

20 return cached;

21 }

22 target = mod != null ? __create(__getProtoOf(mod)) : {};

23

dist/pack.jsView file

•path = dist/pack.js kind = oversized_source_file sizeBytes = 17257493 magicHex = [redacted]

Medium

Oversized Source File

Package contains source files above the normal full-analysis size ceiling.

dist/pack.jsView on unpkg