registry / @uipath/test-manager-tool / 1.201.0
@uipath/test-manager-tool@1.201.0
Manage test cases, test sets, executions, and results.
AI Security Review
scanned 2mo ago · by lpm-firewall-aiThe static signals resolve to bundled CLI functionality: logger-backed telemetry and an explicit pack workflow. No automatic installation execution or concrete malicious behavior was found.
Static reason
One or more suspicious static signals were detected.
Trigger
A user runs the CLI, particularly its pack command.
Impact
The pack command can execute the chosen project's own configuration, which is expected for this feature and is not an unsolicited package action.
Mechanism
CLI test-management operations and user-selected Playwright configuration discovery.
AI rationale
The static signals resolve to bundled CLI functionality: logger-backed telemetry and an explicit pack workflow. No automatic installation execution or concrete malicious behavior was found.
Decision evidence
public snapshotAI called this Clean at 96.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The bundle contains an obfuscated Application Insights connection string, but its local telemetry service uses a logger-only provider.
- The user-invoked pack command runs a selected Playwright configuration in a subprocess.
Evidence against
- package.json has no lifecycle scripts and exposes only library and CLI entry points.
- The CLI entry point only registers commands and parses command-line arguments.
- The configuration subprocess is limited to the supplied project path and has a 30-second timeout.
- No credential harvesting, unsolicited exfiltration, persistence, destructive install behavior, or self-dependency was found.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShell
HighEntropyStringsUrlStrings
Source & flagged code
7 flagged · loading sourcedist/tool-wcqtbzab.jsView file
12818var telemetryInstanceSlot = singleton("TelemetryService");
L12819: var DEFAULT_AI_CONNECTION_STRING = atob("[redacted]...
L12820: function getGlobalTelemetryInstance() {
High
Base64 Obscured Url
Source decodes a Base64-obscured HTTP endpoint at runtime.
dist/tool-wcqtbzab.jsView on unpkg · L12818738var require_command = __commonJS((exports) => {
L739: var EventEmitter = __require("node:events").EventEmitter;
L740: var childProcess = __require("node:child_process");
Medium
Dynamic Require
Package source references dynamic require/import behavior.
dist/tool-wcqtbzab.jsView on unpkg · L7384638if (typeof callback !== "function") {
L4639: callback = new Function("" + callback);
L4640: }
Low
Eval
Package source references a known benign dynamic code generation pattern.
dist/tool-wcqtbzab.jsView on unpkg · L4638Findings
2 High3 Medium7 Low
HighBase64 Obscured Urldist/tool-wcqtbzab.js
HighSemantic Analysis Limiteddist/index-w03qc9m8.js
MediumDynamic Requiredist/tool-wcqtbzab.js
MediumNetwork
MediumEnvironment Vars
LowEvaldist/tool-wcqtbzab.js
LowWeak Cryptodist/tool-wcqtbzab.js
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
LowAi Review Evidencedist/tool-wcqtbzab.js
LowAi Review Evidencedist/tool-wcqtbzab.js
Affected versions and remediation
This report applies to @uipath/test-manager-tool@1.201.0.
See all versions of @uipath/test-manager-tool for other recorded verdicts.
- Review the evidence and your use of @uipath/test-manager-tool@1.201.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.