registry / @uipath/traces-tool / 1.201.0
@uipath/traces-tool@1.201.0
Query execution traces for UiPath jobs
AI Security Review
scanned 2mo ago · by lpm-firewall-aiNo install-time execution, self-dependency, credential harvesting, or confirmed exfiltration path was found. The Base64-obscured telemetry connection string and process-launching URL helper remain suspicious enough to warn because static analysis coverage was incomplete.
Static reason
One or more suspicious static signals were detected.
Trigger
A user invokes the traces-tool CLI command.
Impact
The CLI can access trace data and feedback within the permissions of the user's existing UiPath session.
Mechanism
User-invoked authenticated trace and feedback API requests.
AI rationale
No install-time execution, self-dependency, credential harvesting, or confirmed exfiltration path was found. The Base64-obscured telemetry connection string and process-launching URL helper remain suspicious enough to warn because static analysis coverage was incomplete.
Decision evidence
public snapshotAI called this Suspicious at 70.0% confidence as Unknown with high false-positive risk.
Evidence for warning
- The manifest exposes an executable CLI, so package code runs when the user invokes the command.
- The bundle Base64-decodes a built-in Application Insights telemetry connection string.
- A bundled URL-opening helper can spawn a platform opener process.
Evidence against
- The manifest has no preinstall, install, postinstall, or other lifecycle script.
- The executable registers trace and feedback commands rather than performing work at installation or import time.
- Trace requests are made only from a command action after checking login state and attach the existing UiPath bearer token to the configured service URL.
- The decoded telemetry constant is not used by the shown local telemetry initialization, which selects a logger provider.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsUrlStrings
Source & flagged code
5 flagged · loading sourcedist/tool-e67apx6g.jsView file
3705var telemetryInstanceSlot = singleton("TelemetryService");
L3706: var DEFAULT_AI_CONNECTION_STRING = atob("[redacted]...
L3707: function getGlobalTelemetryInstance() {
High
Base64 Obscured Url
Source decodes a Base64-obscured HTTP endpoint at runtime.
dist/tool-e67apx6g.jsView on unpkg · L37053704// ../common/src/telemetry/telemetry-init.ts
var telemetryInstanceSlot = singleton("TelemetryService");
var DEFAULT_AI_CONNECTION_STRING = atob("[redacted]");
Medium
Ai Review Evidence
The bundle Base64-decodes a built-in Application Insights telemetry connection string.
dist/tool-e67apx6g.jsView on unpkg · L3704dist/index-w03qc9m8.jsView file
•stage = ast_semantic_analysis; reason = ast_alias_growth_limit_exceeded; limitedFiles = 1
High
Semantic Analysis Limited
Findings
2 High5 Medium3 Low
HighBase64 Obscured Urldist/tool-e67apx6g.js
HighSemantic Analysis Limiteddist/index-w03qc9m8.js
MediumNetwork
MediumEnvironment Vars
MediumAi Review Evidencepackage.json
MediumAi Review Evidencedist/tool-e67apx6g.js
MediumAi Review Evidencedist/index-w03qc9m8.js
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to @uipath/traces-tool@1.201.0.
See all versions of @uipath/traces-tool for other recorded verdicts.
- Review the evidence and your use of @uipath/traces-tool@1.201.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.