registry / @uipath/traces-tool / 1.200.0
@uipath/traces-tool@1.200.0
Query execution traces for UiPath jobs
AI Security Review
scanned 28d ago · by lpm-firewall-aiThe inspected entry points are user-invoked and the observed bearer-token requests target URLs constructed from the authenticated service authority. No malicious behavior or lifecycle-triggered attack was found.
Static reason
One or more suspicious static signals were detected.
Trigger
A user invokes the traces-tool CLI command.
Impact
No unconsented install-time execution, persistence, credential harvesting, or unrelated data transfer was found.
Mechanism
The CLI registers commands and makes authenticated requests to the logged-in UiPath authority.
AI rationale
The inspected entry points are user-invoked and the observed bearer-token requests target URLs constructed from the authenticated service authority. No malicious behavior or lifecycle-triggered attack was found.
Decision evidence
public snapshotAI called this Clean at 96.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The manifest exposes a library and CLI entry point without lifecycle hooks.
- The CLI only registers and parses commands when invoked.
- The trace client sends an authenticated request to a URL derived from the logged-in service authority.
- Configured authorities are parsed as URLs and require HTTPS.
- The auxiliary authentication UI escapes title and message values before rendering.
Evidence against
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetwork
HighEntropyStringsUrlStrings
Source & flagged code
7 flagged · loading sourcedist/tool-nvhfxv67.jsView file
17import { fileURLToPath } from "node:url";
L18: import childProcess3 from "node:child_process";
L19: import fs5, { constants as fsConstants2 } from "node:fs/promises";
High
Child Process
Package source references child process execution.
dist/tool-nvhfxv67.jsView on unpkg · L17•stage = ast_semantic_analysis; reason = ast_alias_growth_limit_exceeded; limitedFiles = 1
High
Semantic Analysis Limited
A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.
dist/tool-nvhfxv67.jsView on unpkgdist/tool-3m0fyh3k.jsView file
19Cross-file remote execution chain: dist/tool-3m0fyh3k.js spawns dist/tool-nvhfxv67.js; helper contains network access plus dynamic code execution.
L19: class CommanderError extends Error {
L20: constructor(exitCode, code, message) {
L21: super(message);
...
L737: var EventEmitter = __require("node:events").EventEmitter;
L738: var childProcess = __require("node:child_process");
L739: var path = __require("node:path");
...
L783: this._outputConfiguration = {
L784: writeOut: (str) => process2.stdout.write(str),
L785: writeErr: (str) => process2.stderr.write(str),
...
L2108: });
L2109: // package.json
L2110: var package_default = {
Findings
4 High3 Medium5 Low
HighChild Processdist/tool-nvhfxv67.js
HighCross File Remote Execution Contextdist/tool-3m0fyh3k.js
HighBase64 Obscured Urldist/tool-3m0fyh3k.js
HighSemantic Analysis Limiteddist/tool-nvhfxv67.js
MediumNetwork
MediumEnvironment Vars
MediumStripped Provenance Metadatadist/tool-3m0fyh3k.js
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
LowSuspicious Lifecycle Evidencepackage.json
LowAi Review Evidencedist/index.js
Affected versions and remediation
This report applies to @uipath/traces-tool@1.200.0.
See all versions of @uipath/traces-tool for other recorded verdicts.
- Review the evidence and your use of @uipath/traces-tool@1.200.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.