@uipath/tasks-tool@1.196.0

One or more suspicious static signals were detected.

User runs the tasks-tool binary or imports/registers its commands.

Expected task management API operations and telemetry/auth token exchange; no concrete unconsented malicious behavior identified.

Commander CLI calls UiPath SDK task APIs using existing UiPath auth context.

Static source inspection shows suspicious primitives are bundled dependencies and UiPath SDK/auth/telemetry behavior supporting a task-management CLI, not install-time or hidden malicious execution. The base64 telemetry connection string and child_process usage are explainable by Application Insights/Open/Commander code and do not establish credential exfiltration or payload execution.