@uipath/tasks-tool@1.202.0
Manage Action Center tasks.
AI Security Review
scanned 28d ago · by lpm-firewall-aiThe package has no lifecycle hook, but its token-refresh path can forward a retained credential to an unrestricted configured authority. This warrants a warning for conditional credential exposure rather than a malware block.
Static reason
One or more suspicious static signals were detected.
Trigger
A command invokes token refresh with a custom authority or UIPATH_URL setting.
Impact
An operator-configured unrelated HTTPS endpoint could receive a valid refresh token.
Mechanism
The code resolves the authority into a token endpoint and posts the retained refresh token to it.
AI rationale
The package has no lifecycle hook, but its token-refresh path can forward a retained credential to an unrestricted configured authority. This warrants a warning for conditional credential exposure rather than a malware block.
Evidence
dist/tool-h6cyrz61.js
Network endpoints1
cloud.uipath.com
Decision evidence
public snapshotAI called this Suspicious at 88.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- Package metadata exposes library and CLI entrypoints without lifecycle hooks.
- The configured authority can originate from UIPATH_URL before validation.
- Refresh logic passes a retained refresh token into configuration derived from a custom authority.
- The refresh token is POSTed to the configured token endpoint.
Evidence against
- No install, preinstall, or postinstall hook is declared.
- The observed credential send occurs during token refresh, not package installation or import.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsUrlStrings
NoLicense
Source & flagged code
6 flagged · loading sourcedist/tool-h6cyrz61.jsView file
4328var telemetryInstanceSlot = singleton("TelemetryService");
L4329: var DEFAULT_AI_CONNECTION_STRING = atob("[redacted]...
L4330: function getGlobalTelemetryInstance() {
High
Base64 Obscured Url
Source decodes a Base64-obscured HTTP endpoint at runtime.
dist/tool-h6cyrz61.jsView on unpkg · L43285940baseUrl = process.env.UIPATH_URL;
}
if (!baseUrl && fileAuth.authority) {
baseUrl = fileAuth.authority;
}
if (!baseUrl) {
baseUrl = DEFAULT_BASE_URL;
}
baseUrl = normalizeAndValidateBaseUrl(baseUrl);
let clientId = customClientId;
if (!clientId && fileAuth.clientId) {
clientId = fileAuth.clientId;
}
if (!clientId) {
client
Medium
Stripped Provenance Metadata
The configured authority can originate from UIPATH_URL before validation.
dist/tool-h6cyrz61.jsView on unpkg · L59406978const tokenForIdP = fresh.UIPATH_REFRESH_TOKEN ?? callerRefreshToken;
let refreshedAccess;
let refreshedRefresh;
try {
const config = await resolveConfig({ customAuthority });
const refreshed = await refreshFn({
refreshToken: tokenForIdP,
tokenEndpoint: config.tokenEndpoint,
clientId: config.clientId,
expectedAuthority: customAuthority
});
refreshedAccess = refreshed.accessToken;
refreshedRefresh = refreshed.refreshToken;
} catch (error) {
const isOAuthFailure
Findings
2 High6 Medium4 Low
HighBase64 Obscured Urldist/tool-h6cyrz61.js
HighSemantic Analysis Limiteddist/index-sby22td6.js
MediumNetwork
MediumEnvironment Vars
MediumSuspicious Lifecycle Evidencepackage.json
MediumStripped Provenance Metadatadist/tool-h6cyrz61.js
MediumStripped Provenance Metadatadist/tool-h6cyrz61.js
MediumAi Review Evidencedist/tool-h6cyrz61.js
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
LowNo License
Affected versions and remediation
This report applies to @uipath/tasks-tool@1.202.0.
See all versions of @uipath/tasks-tool for other recorded verdicts.
- Review the evidence and your use of @uipath/tasks-tool@1.202.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.