registry / AI-agent capability abuse / @uipath/solution-tool / 1.202.1

@uipath/solution-tool@1.202.1

Create, pack, publish, and deploy UiPath Automation Solutions.

AI Security Review

scanned 25d ago · by lpm-firewall-ai

This is a concrete explicit-command agent-configuration capability, so it warrants a warning under the agent integration policy. The inspected source does not support a malware or install-hook-abuse finding.

Static reason

One or more suspicious static signals were detected.

Trigger

A user runs a solution initialization command or requests extraction of a downloaded solution.

Impact

These files can influence compatible coding agents that later open the solution; the behavior is explicit-command scoped and does not run during npm installation.

Mechanism

The CLI renders its bundled briefing template and writes missing AGENTS.md and CLAUDE.md files in the selected solution directory.

AI rationale

Evidence

dist/packager-tool-324gr08j.jsdist/packager-tool-7ze6x4r5.jsAGENTS.mdCLAUDE.md

Decision evidence

public snapshot

AI called this Suspicious at 88.0% confidence as Dangerous Capability with medium false-positive risk.

Evidence for warning

The package exposes a user-run CLI binary.
The solution initializer writes AGENTS.md and CLAUDE.md only when briefing content is supplied.
The CLI creates missing agent briefing files in an extracted solution directory after an explicit extract operation.

Evidence against

No install, preinstall, or postinstall hook was present in package.json.
No secret harvesting, unrelated endpoint, remote-code execution, or destructive behavior was identified in the inspected paths.

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

Manifest

NoLicense

scanned 27 file(s), 5.56 MB of source, external domains: alpha.uipath.com, cloud.uipath.com, github.com, govcloud.uipath.us, npm.pkg.github.com, purl.org, schemas.microsoft.com, schemas.openxmlformats.org, timestamp.digicert.com, www.w3.org

Source & flagged code

7 flagged

dist/packager-tool-rqvyf18m.jsView file

Lines 706-747javascript

706 }

707 });

708 similar.sort((a, b) => a.localeCompare(b));

709 if (searchingOptions) {

710 similar = similar.map((candidate) => `--${candidate}`);

711 }

712 if (similar.length > 1) {

713 return `

714(Did you mean one of ${similar.join(", ")}?)`;

715 }

716 if (similar.length === 1) {

717 return `

718(Did you mean ${similar[0]}?)`;

719 }

720 return "";

721 }

722 exports.suggestSimilar = suggestSimilar;

723});

724

725// ../../node_modules/commander/lib/command.js

726var require_command = __commonJS(function(exports) {

727 var EventEmitter = __require("node:events").EventEmitter;

728 var childProcess = __require("node:child_process");

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/packager-tool-rqvyf18m.jsView on unpkg · L726

729 var path2 = __require("node:path");

High

Child Process

Package source references child process execution.

dist/packager-tool-rqvyf18m.jsView on unpkg · L727

730 var fs2 = __require("node:fs");

731 var process2 = __require("node:process");

732 var { Argument, humanReadableArgName } = require_argument();

733 var { CommanderError } = require_error();

734 var { Help, stripColor } = require_help();

735 var { Option, DualOptions } = require_option();

736 var { suggestSimilar } = require_suggestSimilar();

737

738 class Command extends EventEmitter {

739 constructor(name) {

740 super();

741 this.commands = [];

742 this.options = [];

743 this.parent = null;

744 this._allowUnknownOption = false;

745 this._allowExcessArguments = false;

746 this.registeredArguments = [];

747 this._args = this.registeredArguments;

Lines 3915-3955javascript

3915 }

3916 getState().commandStart = performance.now();

3917}

3918function recordCommandDuration(durationMs) {

3919 if (!timingsEnabled()) {

3920 return;

dist/packager-tool-f46c7htx.jsView file

162var execFile; L163: var powerShellPath = () => `${process3.env.SYSTEMROOT || process3.env.windir || String.raw`C:\Windows`}\\System32\\WindowsPowerShell\\v1.0\\powershell.exe`; L164: var executePowerShell = async (command, options = {}) => {

High

Shell

Package source references shell execution.

dist/packager-tool-f46c7htx.jsView on unpkg · L162

54Cross-file remote execution chain: dist/packager-tool-f46c7htx.js spawns dist/packager-tool-rqvyf18m.js; helper contains network access plus dynamic code execution. L54: import { promisify } from "node:util"; L55: import childProcess from "node:child_process"; L56: import { promisify as promisify2 } from "node:util"; ... L186: ]; L187: executePowerShell.encodeCommand = (command) => Buffer2.from(command, "utf16le").toString("base64"); L188: executePowerShell.escapeArgument = (value) => `'${String(value).replaceAll("'", "''")}'`; ... L225: const command = String.raw`(Get-ItemProperty -Path "HKCU:\Software\Microsoft\Windows\Shell\Associations\UrlAssociations\http\UserChoice").ProgId`; L226: const { stdout } = await executePowerShell(command, { powerShellPath: psPath }); L227: return stdout.tr

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/packager-tool-f46c7htx.jsView on unpkg · L54

dist/packager-tool-7ze6x4r5.jsView file

•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration. dist/packager-tool-7ze6x4r5.js: async function deleteSolutionOnStudioWeb(baseUrl, organizationName, tenantId, accessToken, solutionId) { const url = `${baseUrl}/${organizationName}/studio_/backend/api/Solution/${encodeURIComponent(solutionId)}`; Authorization: `Bearer ${accessToken}`, if (loginStatus.loginStatus !== "Logged in" || !loginStatus.accessToken || !loginStatus.baseUrl || !loginStatus.organizationName || !loginStatus.tenantId) { const [deleteError] = await catchError(deleteSolutionOnStudioWeb(loginStatus.baseUrl, loginStatus.organizationName, loginStatus.tenantId, loginStatus.accessToken, solutionId)); const [writeError] = aw

High

Credential Redirect Persistence

Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.

dist/packager-tool-7ze6x4r5.jsView on unpkg

dist/index-sby22td6.jsView file

•stage = ast_semantic_analysis; reason = ast_alias_growth_limit_exceeded; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/index-sby22td6.jsView on unpkg

Source & flagged code

7 flagged · loading source

dist/packager-tool-rqvyf18m.jsView file

727var EventEmitter = __require("node:events").EventEmitter; L728: var childProcess = __require("node:child_process"); L729: var path2 = __require("node:path");

High

Child Process

Package source references child process execution.

dist/packager-tool-rqvyf18m.jsView on unpkg · L727

3935var telemetryInstanceSlot = singleton("TelemetryService"); L3936: var DEFAULT_AI_CONNECTION_STRING = atob("[redacted]... L3937: function getGlobalTelemetryInstance() {

High

Base64 Obscured Url

Source decodes a Base64-obscured HTTP endpoint at runtime.

dist/packager-tool-rqvyf18m.jsView on unpkg · L3935

726var require_command = __commonJS(function(exports) { L727: var EventEmitter = __require("node:events").EventEmitter; L728: var childProcess = __require("node:child_process");

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/packager-tool-rqvyf18m.jsView on unpkg · L726

Findings

6 High3 Medium5 Low

HighChild Processdist/packager-tool-rqvyf18m.js

HighShelldist/packager-tool-f46c7htx.js

HighCredential Redirect Persistencedist/packager-tool-7ze6x4r5.js

HighCross File Remote Execution Contextdist/packager-tool-f46c7htx.js

HighBase64 Obscured Urldist/packager-tool-rqvyf18m.js

HighSemantic Analysis Limiteddist/index-sby22td6.js

MediumDynamic Requiredist/packager-tool-rqvyf18m.js

MediumNetwork

MediumEnvironment Vars

LowEval

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

LowNo License

Affected versions and remediation

This report applies to @uipath/solution-tool@1.202.1.

See all versions of @uipath/solution-tool for other recorded verdicts.

Review the evidence and your use of @uipath/solution-tool@1.202.1 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-09-29 08:35:45.226Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Related packages

More from @uipath

Behavioral surface

Related packages

More from @uipath

Source & flagged code