registry / @uipath/traces-tool / 1.203.0

@uipath/traces-tool@1.203.0

Query execution traces for UiPath jobs

AI Security Review

scanned 12d ago · by lpm-firewall-ai

Inspected the manifest and all required source paths. The network and environment signals are consistent with an authenticated UiPath trace client, and the source does not establish a concrete attack surface.

Static reason

One or more suspicious static signals were detected.

Trigger

Use the package CLI or library entrypoint to query traces.

Impact

No malicious effect was established from the inspected source.

Mechanism

Requests use the configured UiPath service with a bearer token; no confirmed unrelated credential destination or malicious execution chain was found.

AI rationale

Network endpoints1

cloud.uipath.com

Decision evidence

public snapshot

AI called this Clean at 86.0% confidence as Benign with low false-positive risk.

Evidence for AI clean decision

package.json identifies the package as a UiPath tool for querying job traces and exposes CLI and library entrypoints.
The active client uses UiPath Cloud as its default authentication authority and sends bearer tokens with API requests.
The required source paths show no confirmed malicious behavior; the bundled browser-opening dependency is consistent with CLI support.

Evidence against

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetwork

Supply chain

HighEntropyStringsUrlStrings

Manifest

NoLicense

scanned 7 file(s), 636 KB of source, external domains: alpha.uipath.com, cloud.uipath.com, github.com, govcloud.uipath.us, npm.pkg.github.com

Source & flagged code

6 flagged

dist/tool-1j0r8ws5.jsView file

Lines 4357-4397javascript

4357 }

4358 getState().commandStart = performance.now();

4359}

4360function recordCommandDuration(durationMs) {

4361 if (!timingsEnabled()) {

4362 return;

4363 }

4364 getState().commandMs = durationMs;

4365}

4366// ../common/src/telemetry/proxy-http-agent.ts

4367var slot = singleton("ProxyAuthHttpsAgent");

4368

4369// ../common/src/telemetry/node-appinsights-telemetry-provider.ts

4370var providerSlot = singleton("TelemetryProvider");

4371

4372// ../common/src/telemetry/telemetry-spool.ts

4373var sidecarEntrySlot = singleton("TelemetrySidecarEntry");

4374var MAX_SPOOL_AGE_MS = 72 * 60 * 60 * 1000;

4375

4376// ../common/src/telemetry/telemetry-init.ts

4377var telemetryInstanceSlot = singleton("TelemetryService");

4378var DEFAULT_AI_CONNECTION_STRING = atob("SW5zdHJ1bWVudGF0aW9uS2V5PTliZDM3NDgyLTgxMGUtNDQyYS1hYWE2LWQzOGVmNjVjNjY3NDtJbmdlc3Rpb25FbmRwb2ludD1odHRwczovL3dlc3RldXJvcGUtNS5pbi5hcHBsaWNhdGlvbmluc2lnaHRzLmF6dXJlLmNvbS87TGl2ZUVuZHBvaW50PWh0dHBzOi8vd2VzdGV1cm9wZS5saXZlZGlhZ25vc3RpY3MubW9uaXRvci5henVyZS5jb20vO0FwcGxpY2F0aW9uSWQ9MzU2OTdlZjEtOGJkMC00ZjE5LWEyN2MtZDg3Y2NhYzY2ZDJj");

4379function getGlobalTelemetryInstance() {

High

Base64 Obscured Url

Source decodes a Base64-obscured HTTP endpoint at runtime.

dist/tool-1j0r8ws5.jsView on unpkg · L4377

4380 const existing = telemetryInstanceSlot.get();

4381 if (existing && typeof existing === "object" && "trackEvent" in existing && typeof existing.trackEvent === "function") {

4382 return existing;

4383 }

4384 return;

4385}

4386function setGlobalTelemetryInstance(instance) {

4387 telemetryInstanceSlot.set(instance);

4388}

4389var _localTelemetryInstance;

4390function getTelemetryInstance() {

4391 const global = getGlobalTelemetryInstance();

4392 if (global)

4393 return global;

4394 if (!_localTelemetryInstance) {

4395 _localTelemetryInstance = new TelemetryService(new LoggerTelemetryProvider, new NodeContextStorage);

4396 setGlobalTelemetryInstance(_localTelemetryInstance);

4397 }

Lines 6292-6332javascript

6292 return settlePromiseLike2(result);

6293 }

6294 return [undefined, result];

6295 } catch (error) {

6296 return [

6297 error instanceof Error ? error

Lines 7637-7677javascript

7637 if (loginError) {

7638 throw new Error(loginError.message);

7639 }

7640 if (loginStatus2.loginStatus !== "Logged in" || !loginStatus2.baseUrl) {

7641 throw new

dist/index-sby22td6.jsView file

Lines 1-21javascript

1import"./tool-1de529jm.js";

3// ../../node_modules/open/index.js

4import process7 from "node:process";

5import path from "node:path";

6import { fileURLToPath } from "node:url"

package.jsonView file

Lines 1-21json

2 "name": "@uipath/traces-tool",

3 "author": "UiPath",

4 "license": "SEE LICENSE IN LICENSE.txt",

5 "version": "1.203.0",

Source & flagged code

6 flagged · loading source

dist/tool-1j0r8ws5.jsView file

4377var telemetryInstanceSlot = singleton("TelemetryService"); L4378: var DEFAULT_AI_CONNECTION_STRING = atob("[redacted]... L4379: function getGlobalTelemetryInstance() {

High

Base64 Obscured Url

Source decodes a Base64-obscured HTTP endpoint at runtime.

dist/tool-1j0r8ws5.jsView on unpkg · L4377

6312var DEFAULT_BASE_URL = "https://cloud.uipath.com"; var DEFAULT_AUTH_TIMEOUT_MS2 = 5 * 60 * 1000; // ../auth/src/config.ts var DEFAULT_CLIENT_ID = "36dea5b8-e8bb-423d-8e7

Medium

Stripped Provenance Metadata

The active client uses UiPath Cloud as its default authentication authority and sends bearer tokens with API requests.

dist/tool-1j0r8ws5.jsView on unpkg · L6312

7657async function apiFetch(url, token, folderKey, method = "GET", body) { const headers = { Authorization: `Bearer ${token}`, "Content-Type": "application/json", Accept: "application/json" }; if (folderKey

Medium

Stripped Provenance Metadata

The active client uses UiPath Cloud as its default authentication authority and sends bearer tokens with API requests.

dist/tool-1j0r8ws5.js

Findings

2 High4 Medium6 Low

HighBase64 Obscured Urldist/tool-1j0r8ws5.js

HighSemantic Analysis Limiteddist/index-sby22td6.js

MediumNetwork

MediumEnvironment Vars

MediumStripped Provenance Metadatadist/tool-1j0r8ws5.js

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

LowNo License

LowAi Review Evidencepackage.json

LowSuspicious Dependency Evidencedist/index-sby22td6.js

Affected versions and remediation

This report applies to @uipath/traces-tool@1.203.0.

See all versions of @uipath/traces-tool for other recorded verdicts.

Review the evidence and your use of @uipath/traces-tool@1.203.0 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-10-11 18:01:16.201Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Related packages

More from @uipath

Behavioral surface

Related packages

More from @uipath

Source & flagged code