registry / @uipath/tasks-tool / 1.202.1
@uipath/tasks-tool@1.202.1
Manage Action Center tasks.
AI Security Review
scanned 28d ago · by lpm-firewall-aiStatic inspection shows a first-party UiPath tasks CLI with no lifecycle scripts and credentials used only against the configured UiPath base URL. Shell and telemetry helpers are package-aligned dependencies invoked by that CLI.
Static reason
One or more suspicious static signals were detected.
Trigger
A user runs the tasks-tool binary or imports registerCommands.
Impact
No unconsented install mutation, credential theft, or remote payload execution was found.
Mechanism
Commands authenticate to the configured UiPath orchestrator and issue task-management API calls.
AI rationale
Static inspection shows a first-party UiPath tasks CLI with no lifecycle scripts and credentials used only against the configured UiPath base URL. Shell and telemetry helpers are package-aligned dependencies invoked by that CLI.
Decision evidence
public snapshotAI called this Clean at 86.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- package.json names @uipath/tasks-tool 1.202.1, publishes only dist, and defines main and bin with no install lifecycle scripts.
- Auth constants store a local .uipath/.auth profile and default the service base to https://cloud.uipath.com.
- dist/index-sby22td6.js is a bundled open/WSL helper graph loaded by the CLI, not an install-time payload.
Evidence against
- child_process appears only in OpenTelemetry machine-id detectors and the bundled open/PowerShell helpers.
- Orchestrator requests use the signed-in context base URL with a bearer token, and a generated alpha.uipath.com default is overridden by that config.
- Azure Application Insights telemetry is a fixed first-party endpoint, not a hidden recipient of secrets.
Behavioral surface
ChildProcessCryptoEnvironmentVarsEvalFilesystemNetwork
HighEntropyStringsUrlStrings
Source & flagged code
5 flagged · loading sourcedist/tool-fqszw775.jsView file
4328var telemetryInstanceSlot = singleton("TelemetryService");
L4329: var DEFAULT_AI_CONNECTION_STRING = atob("[redacted]...
L4330: function getGlobalTelemetryInstance() {
High
Base64 Obscured Url
Source decodes a Base64-obscured HTTP endpoint at runtime.
dist/tool-fqszw775.jsView on unpkg · L43285801var UIPATH_HOME_DIR = ".uipath";
var AUTH_FILENAME = ".auth";
var DEFAULT_BASE_URL = "https://cloud.uipath.com";
var DEFAULT_AUTH_TIMEOUT_MS
Low
Ai Review Evidence
Auth constants store a local .uipath/.auth profile and default the service base to https://cloud.uipath.com.
dist/tool-fqszw775.jsView on unpkg · L5801dist/index-sby22td6.jsView file
•stage = ast_semantic_analysis; reason = ast_alias_growth_limit_exceeded; limitedFiles = 1
High
Semantic Analysis Limited
Findings
2 High2 Medium8 Low
HighBase64 Obscured Urldist/tool-fqszw775.js
HighSemantic Analysis Limiteddist/index-sby22td6.js
MediumNetwork
MediumEnvironment Vars
LowEval
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
LowNo License
LowSuspicious Lifecycle Evidencepackage.json
LowAi Review Evidencedist/tool-fqszw775.js
LowAi Review Evidencedist/index-sby22td6.js
Affected versions and remediation
This report applies to @uipath/tasks-tool@1.202.1.
See all versions of @uipath/tasks-tool for other recorded verdicts.
- Review the evidence and your use of @uipath/tasks-tool@1.202.1 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.