@uipath/test-manager-tool: Clean npm security report (Allow)

Loading npm security reports…

Source & flagged code

4 flagged

dist/index.jsView file

Lines 19-59javascript

19 if (cached)

20 return cached;

21 }

22 target = mod != null ? __create(__getProtoOf(mod)) : {};

23 const to = isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target;

24 for (let key of __getOwnPropNames(mod))

25 if (!__hasOwnProp.call(to, key))

26 __defProp(to, key, {

27 get: __accessProp.bind(mod, key),

28 enumerable: true

29 });

30 if (canCache)

31 cache.set(mod, to);

32 return to;

33};

34var __commonJS = (cb, mod) => () => (mod || cb((mod = { exports: {} }).exports, mod), mod.exports);

35var __require = /* @__PURE__ */ createRequire(import.meta.url);

37// ../../node_modules/commander/lib/error.js

38var require_error = __commonJS((exports) => {

39 class CommanderError extends Error {

40 constructor(exitCode, code, message) {

41 super(message);

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/index.jsView on unpkg · L39

42 Error.captureStackTrace(this, this.constructor);

43 this.name = this.constructor.name;

44 this.code = code;

45 this.exitCode = exitCode;

46 this.nestedError = undefined;

47 }

48 }

50 class InvalidArgumentError extends CommanderError {

51 constructor(message) {

52 super(1, "commander.invalidArgument", message);

53 Error.captureStackTrace(this, this.constructor);

54 this.name = this.constructor.name;

55 }

56 }

57 exports.CommanderError = CommanderError;

58 exports.InvalidArgumentError = InvalidArgumentError;

59});

Lines 737-777javascript

737 });

738 similar.sort((a, b) => a.localeCompare(b));

739 if (searchingOptions) {

740 similar = similar.map((candidate) => `--${candidate}`);

dist/tool.jsView file

110L111: // ../../node_modules/powershell-utils/index.js L112: import process3 from "node:process";

High

Shell

Package source references shell execution.

dist/tool.jsView on unpkg · L110

26754var telemetryInstanceSlot = singleton("TelemetryService"); L26755: var DEFAULT_AI_CONNECTION_STRING = atob("[redacted]... L26756: function getGlobalTelemetryInstance() {

High

Base64 Obscured Url

Source decodes a Base64-obscured HTTP endpoint at runtime.

dist/tool.jsView on unpkg · L26754

Source & flagged code

4 flagged · loading source

dist/index.jsView file

757var EventEmitter = __require("node:events").EventEmitter; L758: var childProcess = __require("node:child_process"); L759: var path = __require("node:path");

High

Child Process

Package source references child process execution.

dist/index.jsView on unpkg · L757

39Cross-file remote execution chain: dist/index.js spawns dist/tool.js; helper contains network access plus dynamic code execution. L39: class CommanderError extends Error { L40: constructor(exitCode, code, message) { L41: super(message); ... L757: var EventEmitter = __require("node:events").EventEmitter; L758: var childProcess = __require("node:child_process"); L759: var path = __require("node:path"); ... L803: this._outputConfiguration = { L804: writeOut: (str) => process2.stdout.write(str), L805: writeErr: (str) => process2.stderr.write(str),

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/index.jsView on unpkg · L39

dist/tool.jsView file

110

@uipath/test-manager-tool: Clean npm security report (Allow) | LPM Firewall

Source & flagged code

4 flagged

dist/index.jsView file

Lines 19-59javascript

19 if (cached)

20 return cached;

21 }

22 target = mod != null ? __create(__getProtoOf(mod)) : {};

23 const to = isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target;

24 for (let key of __getOwnPropNames(mod))

25 if (!__hasOwnProp.call(to, key))

26 __defProp(to, key, {

27 get: __accessProp.bind(mod, key),

28 enumerable: true

29 });

30 if (canCache)

31 cache.set(mod, to);

32 return to;

33};

34var __commonJS = (cb, mod) => () => (mod || cb((mod = { exports: {} }).exports, mod), mod.exports);

35var __require = /* @__PURE__ */ createRequire(import.meta.url);

37// ../../node_modules/commander/lib/error.js

38var require_error = __commonJS((exports) => {

39 class CommanderError extends Error {

40 constructor(exitCode, code, message) {

41 super(message);

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/index.jsView on unpkg · L39

42 Error.captureStackTrace(this, this.constructor);

43 this.name = this.constructor.name;

44 this.code = code;

45 this.exitCode = exitCode;

46 this.nestedError = undefined;

47 }

48 }

50 class InvalidArgumentError extends CommanderError {

51 constructor(message) {

52 super(1, "commander.invalidArgument", message);

53 Error.captureStackTrace(this, this.constructor);

54 this.name = this.constructor.name;

55 }

56 }

57 exports.CommanderError = CommanderError;

58 exports.InvalidArgumentError = InvalidArgumentError;

59});

Lines 737-777javascript

737 });

738 similar.sort((a, b) => a.localeCompare(b));

739 if (searchingOptions) {

740 similar = similar.map((candidate) => `--${candidate}`);

dist/tool.jsView file

110L111: // ../../node_modules/powershell-utils/index.js L112: import process3 from "node:process";

High

Shell

Package source references shell execution.

dist/tool.jsView on unpkg · L110

26754var telemetryInstanceSlot = singleton("TelemetryService"); L26755: var DEFAULT_AI_CONNECTION_STRING = atob("[redacted]... L26756: function getGlobalTelemetryInstance() {

High

Base64 Obscured Url

Source decodes a Base64-obscured HTTP endpoint at runtime.

dist/tool.jsView on unpkg · L26754

@uipath/test-manager-tool

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Behavioral surface

Source & flagged code