registry / @uipath/uipath-python-bridge / 1.202.1

@uipath/uipath-python-bridge@1.202.1

Shared Python detection, caching, and CLI bridge for UiPath Python SDK tools.

AI Security Review

scanned 28d ago · by lpm-firewall-ai

Static review found no lifecycle hook, hidden payload, or unconsented agent-surface write. Local process execution and https token refresh are package-aligned CLI behavior activated by the caller.

Static reason

One or more suspicious static signals were detected.

Trigger

A consumer imports the package and calls an exported helper such as a setup or execute command.

Impact

No unsolicited credential theft, remote payload execution, persistence, or agent control-surface mutation was established.

Mechanism

Helpers detect a local Python runtime, cache paths, and optionally refresh tokens against an https UiPath authority supplied by configuration.

AI rationale

Static review found no lifecycle hook, hidden payload, or unconsented agent-surface write. Local process execution and https token refresh are package-aligned CLI behavior activated by the caller.

Decision evidence

public snapshot

AI called this Clean at 86.0% confidence as Benign with low false-positive risk.

Evidence for AI clean decision

package.json names the published ESM entry ./dist/index.js and contains no install lifecycle scripts or dependencies.
dist/index.js only exports Python detection, cache, and CLI bridge helpers that run when an importer calls them.
OIDC authority URLs must use https before any token exchange to the configured UiPath identity host.

Evidence against

The bundle imports node:child_process and can spawn local Python or Windows reg queries when those helpers are called.
Auth code posts a refresh token to a caller-configured https authority path /identity_/connect/token, which is the product identity service including self-hosted hosts.

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetwork

Supply chain

HighEntropyStringsUrlStrings

Manifest

NoLicense

scanned 1 file(s), 419 KB of source, external domains: cloud.uipath.com, govcloud.uipath.us, www.python.org

Source & flagged code

4 flagged

dist/index.jsView file

Lines 9276-9316javascript

9276 getState().commandStart = performance.now();

9277}

9278function recordCommandDuration(durationMs) {

9279 if (!timingsEnabled()) {

9280 return;

9281 }

9282 getState().commandMs = durationMs;

9283}

9284// ../common/src/telemetry/proxy-http-agent.ts

9285var slot = singleton("ProxyAuthHttpsAgent");

9286

9287// ../common/src/telemetry/node-appinsights-telemetry-provider.ts

9288var providerSlot = singleton("TelemetryProvider");

9289

9290// ../common/src/telemetry/telemetry-spool.ts

9291init_src();

9292var sidecarEntrySlot = singleton("TelemetrySidecarEntry");

9293var MAX_SPOOL_AGE_MS = 72 * 60 * 60 * 1000;

9294

9295// ../common/src/telemetry/telemetry-init.ts

9296var telemetryInstanceSlot = singleton("TelemetryService");

9297var DEFAULT_AI_CONNECTION_STRING = atob("SW5zdHJ1bWVudGF0aW9uS2V5PTliZDM3NDgyLTgxMGUtNDQyYS1hYWE2LWQzOGVmNjVjNjY3NDtJbmdlc3Rpb25FbmRwb2ludD1odHRwczovL3dlc3RldXJvcGUtNS5pbi5hcHBsaWNhdGlvbmluc2lnaHRzLmF6dXJlLmNvbS87TGl2ZUVuZHBvaW50PWh0dHBzOi8vd2VzdGV1cm9wZS5saXZlZGlhZ25vc3RpY3MubW9uaXRvci5henVyZS5jb20vO0FwcGxpY2F0aW9uSWQ9MzU2OTdlZjEtOGJkMC00ZjE5LWEyN2MtZDg3Y2NhYzY2ZDJj");

9298function getGlobalTelemetryInstance() {

High

Base64 Obscured Url

Source decodes a Base64-obscured HTTP endpoint at runtime.

dist/index.jsView on unpkg · L9296

9299 const existing = telemetryInstanceSlot.get();

9300 if (existing && typeof existing === "object" && "trackEvent" in existing && typeof existing.trackEvent === "function") {

9301 return existing;

9302 }

9303 return;

9304}

9305function setGlobalTelemetryInstance(instance) {

9306 telemetryInstanceSlot.set(instance);

9307}

9308var _localTelemetryInstance;

9309function getTelemetryInstance() {

9310 const global = getGlobalTelemetryInstance();

9311 if (global)

9312 return global;

9313 if (!_localTelemetryInstance) {

9314 _localTelemetryInstance = new TelemetryService(new LoggerTelemetryProvider, new NodeContextStorage);

9315 setGlobalTelemetryInstance(_localTelemetryInstance);

9316 }

Lines 10755-10795javascript

10755 let baseUrl = rawUrl;

10756 if (baseUrl.endsWith("/identity_/")) {

10757 baseUrl = baseUrl.slice(0, -11);

10758 } else if (baseUrl.

Lines 12713-12749javascript

12713function normalizeDefaultActionArgs(args) {

12714 return args.length === 1 && args[0] === "-h" ? ["--help"] : args;

12715

package.jsonView file

Lines 1-21json

2 "name": "@uipath/uipath-python-bridge",

3 "license": "SEE LICENSE IN LICENSE.txt",

4 "version": "1.202.1",

5 "description": "Shared Python detection, caching, and CLI bridge for UiPath Python SDK tools.",

Source & flagged code

4 flagged · loading source

dist/index.jsView file

9296var telemetryInstanceSlot = singleton("TelemetryService"); L9297: var DEFAULT_AI_CONNECTION_STRING = atob("[redacted]... L9298: function getGlobalTelemetryInstance() {

High

Base64 Obscured Url

Source decodes a Base64-obscured HTTP endpoint at runtime.

dist/index.jsView on unpkg · L9296

10775if (url.protocol !== "https:") { throw new InvalidBaseUrlError(baseUrl, `Authority must use https:// scheme, got ${url.protocol}//. OIDC token exchange re

Medium

Stripped Provenance Metadata

OIDC authority URLs must use https before any token exchange to the configured UiPath identity host.

dist/index.jsView on unpkg · L10775

12733export { PythonService, createCommandForwarder, createDefaultAction, createExecuteCommand, createHelpCommand, createSetupCommand, getAllowedPythonVersions, getCache

Low

Ai Review Evidence

dist/index.js only exports Python detection, cache, and CLI bridge helpers that run when an importer calls them.

dist/index.jsView on unpkg · L12733

Findings

1 High3 Medium6 Low

HighBase64 Obscured Urldist/index.js

MediumNetwork

MediumEnvironment Vars

MediumStripped Provenance Metadatadist/index.js

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

LowNo License

LowSuspicious Lifecycle Evidencepackage.json

LowAi Review Evidencedist/index.js

Affected versions and remediation

This report applies to @uipath/uipath-python-bridge@1.202.1.

See all versions of @uipath/uipath-python-bridge for other recorded verdicts.

Review the evidence and your use of @uipath/uipath-python-bridge@1.202.1 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-09-26 03:55:11.233Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Related packages

More from @uipath

Behavioral surface

Related packages

More from @uipath

Source & flagged code