registry / @uipath/uipath-python-bridge / 1.203.0

@uipath/uipath-python-bridge@1.203.0

Shared Python detection, caching, and CLI bridge for UiPath Python SDK tools.

AI Security Review

scanned 12d ago · by lpm-firewall-ai

The manifest exposes a library entrypoint without lifecycle hooks. The flagged decoding supports JWT claim parsing, while refresh requests use the configured UiPath authority; these inspected facts do not establish malicious behavior.

Static reason

One or more suspicious static signals were detected.

Trigger

A caller invokes token refresh with a refresh token and token endpoint.

Impact

No confirmed attack surface was established in the inspected source.

Mechanism

The code sends the refresh token to the supplied token endpoint and parses JWT claims using base64 decoding.

AI rationale

Evidence

dist/index.js

Network endpoints2

cloud.uipath.comgovcloud.uipath.us

Decision evidence

public snapshot

AI called this Clean at 94.0% confidence as Benign with low false-positive risk.

Evidence for AI clean decision

The manifest exposes dist/index.js as the package entrypoint and defines no lifecycle scripts.
The entrypoint uses configured UiPath authority data to construct the identity token endpoint and refreshes a supplied refresh token there.
The base64 decoding is part of parsing JWT payloads for claims, not an obscured network endpoint.

Evidence against

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetwork

Supply chain

HighEntropyStringsUrlStrings

Manifest

NoLicense

scanned 1 file(s), 438 KB of source, external domains: cloud.uipath.com, govcloud.uipath.us, www.python.org

Source & flagged code

5 flagged

dist/index.jsView file

Lines 9281-9321javascript

9281 getState().commandStart = performance.now();

9282}

9283function recordCommandDuration(durationMs) {

9284 if (!timingsEnabled()) {

9285 return;

9286 }

9287 getState().commandMs = durationMs;

9288}

9289// ../common/src/telemetry/proxy-http-agent.ts

9290var slot = singleton("ProxyAuthHttpsAgent");

9291

9292// ../common/src/telemetry/node-appinsights-telemetry-provider.ts

9293var providerSlot = singleton("TelemetryProvider");

9294

9295// ../common/src/telemetry/telemetry-spool.ts

9296init_src();

9297var sidecarEntrySlot = singleton("TelemetrySidecarEntry");

9298var MAX_SPOOL_AGE_MS = 72 * 60 * 60 * 1000;

9299

9300// ../common/src/telemetry/telemetry-init.ts

9301var telemetryInstanceSlot = singleton("TelemetryService");

9302var DEFAULT_AI_CONNECTION_STRING = atob("SW5zdHJ1bWVudGF0aW9uS2V5PTliZDM3NDgyLTgxMGUtNDQyYS1hYWE2LWQzOGVmNjVjNjY3NDtJbmdlc3Rpb25FbmRwb2ludD1odHRwczovL3dlc3RldXJvcGUtNS5pbi5hcHBsaWNhdGlvbmluc2lnaHRzLmF6dXJlLmNvbS87TGl2ZUVuZHBvaW50PWh0dHBzOi8vd2VzdGV1cm9wZS5saXZlZGlhZ25vc3RpY3MubW9uaXRvci5henVyZS5jb20vO0FwcGxpY2F0aW9uSWQ9MzU2OTdlZjEtOGJkMC00ZjE5LWEyN2MtZDg3Y2NhYzY2ZDJj");

9303function getGlobalTelemetryInstance() {

High

Base64 Obscured Url

Source decodes a Base64-obscured HTTP endpoint at runtime.

dist/index.jsView on unpkg · L9301

9304 const existing = telemetryInstanceSlot.get();

9305 if (existing && typeof existing === "object" && "trackEvent" in existing && typeof existing.trackEvent === "function") {

9306 return existing;

9307 }

9308 return;

9309}

9310function setGlobalTelemetryInstance(instance) {

9311 telemetryInstanceSlot.set(instance);

9312}

9313var _localTelemetryInstance;

9314function getTelemetryInstance() {

9315 const global = getGlobalTelemetryInstance();

9316 if (global)

9317 return global;

9318 if (!_localTelemetryInstance) {

9319 _localTelemetryInstance = new TelemetryService(new LoggerTelemetryProvider, new NodeContextStorage);

9320 setGlobalTelemetryInstance(_localTelemetryInstance);

9321 }

Lines 11233-11273javascript

11233var resolveConfigAsync = async ({

11234 customAuthority,

11235 customClientId,

11236 customClientSecret,

11237 customClientAssertion,

11238 customScopes

11239} = {}) => {

11240 const

Lines 11357-11397javascript

11357` + `Actual: ${actualText}

11358

11359` + `The identity server that issued this token is not the one ` + `you pointed --authority at. Refusing to save credentials.`);

11360 this.expected = expected;

11361 this.actual = actual;

11362 this.name = "InvalidIssuerError";

11363 }

11364}

11365var parseJWT = (token) => {

Lines 11765-11805javascript

11765 await catchError2(() => withTimeout(proxy.CloseAsync(), CLOSE_TIMEOUT_MS));

11766 }

11767};

11768

11769// ../auth/src/tokenRefresh.ts

11770var TOKEN_REFRESH_REAUTHENTICATE_MESSAGE = "Token refresh failed. Run 'uip login' to re-authenticate."

package.jsonView file

Lines 1-30json

2 "name": "@uipath/uipath-python-bridge",

3 "author": "UiPath",

4 "license": "SEE LICENSE IN LICENSE.txt",

5 "version": "1.203.0",

Source & flagged code

5 flagged · loading source

dist/index.jsView file

9301var telemetryInstanceSlot = singleton("TelemetryService"); L9302: var DEFAULT_AI_CONNECTION_STRING = atob("[redacted]... L9303: function getGlobalTelemetryInstance() {

High

Base64 Obscured Url

Source decodes a Base64-obscured HTTP endpoint at runtime.

dist/index.jsView on unpkg · L9301

11253if (!clientId && fileAuth.clientId) { clientId = fileAuth.clientId; } if (!clientId) { clientId = DEFAULT_CLIENT_ID; } let clientSecret = customClientSecret; if (!clientSecret && fileAuth.clientSecret) { clientSecret = fileAut

Medium

Stripped Provenance Metadata

The entrypoint uses configured UiPath authority data to construct the identity token endpoint and refreshes a supplied refresh token there.

dist/index.jsView on unpkg · L11253

11785clientId, expectedAuthority }) => { const tokenParams = new URLSearchParams({ grant_type: "refresh_token", refresh_token: refreshToken, client_id: clientId }); const tokenResponse = await fetch(tokenEndpoint, { method: "POST", headers: { "Content-Type": "applicati

Medium

Stripped Provenance Metadata

The entrypoint uses configured UiPath authority data to construct the identity token endpoint and refreshes a supplied refresh token there.

Findings

1 High4 Medium6 Low

HighBase64 Obscured Urldist/index.js

MediumNetwork

MediumEnvironment Vars

MediumStripped Provenance Metadatadist/index.js

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

LowNo License

LowSuspicious Lifecycle Evidencepackage.json

LowAi Review Evidencedist/index.js

Affected versions and remediation

This report applies to @uipath/uipath-python-bridge@1.203.0.

See all versions of @uipath/uipath-python-bridge for other recorded verdicts.

Review the evidence and your use of @uipath/uipath-python-bridge@1.203.0 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-10-11 18:03:00.612Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Related packages

More from @uipath

Behavioral surface

Related packages

More from @uipath

Source & flagged code