registry / @uipath/vertical-solutions-tool / 1.201.0
@uipath/vertical-solutions-tool@1.201.0
Scaffold and generate Vertical Solution projects.
AI Security Review
scanned 2mo ago · by lpm-firewall-aiThis is a user-invoked UiPath project CLI with no lifecycle hooks. The static alerts resolve to normal browser-opening support, JWT Base64 parsing, and package-aligned telemetry rather than malicious behavior.
Static reason
One or more suspicious static signals were detected.
Trigger
A user invokes the vertical-solutions-tool CLI.
Impact
No confirmed unauthorized execution, exfiltration, persistence, or destructive behavior.
Mechanism
User-invoked project scaffolding, synchronization, and telemetry.
AI rationale
This is a user-invoked UiPath project CLI with no lifecycle hooks. The static alerts resolve to normal browser-opening support, JWT Base64 parsing, and package-aligned telemetry rather than malicious behavior.
Decision evidence
public snapshotAI called this Clean at 94.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The manifest exposes a CLI and library entry point and declares no lifecycle scripts.
- The highlighted launcher module is vendored browser-opening support that imports child-process facilities.
- The Base64 logic decodes a JWT payload and reads only its subject claim.
- Runtime telemetry posts event payloads to a configured Application Insights endpoint.
Evidence against
- No install-time execution, self-dependency, credential harvesting, or agent-control-surface writes were found.
- Project files are written only by explicit init and sync CLI commands.
- The reported Base64 signal is structured token parsing, not an obscured network endpoint.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsUrlStrings
Source & flagged code
6 flagged · loading sourcedist/tool-q8sxr78k.jsView file
8132var telemetryInstanceSlot = singleton("TelemetryService");
L8133: var DEFAULT_AI_CONNECTION_STRING = atob("[redacted]...
L8134: function getGlobalTelemetryInstance() {
High
Base64 Obscured Url
Source decodes a Base64-obscured HTTP endpoint at runtime.
dist/tool-q8sxr78k.jsView on unpkg · L813235517function base64UrlToBase64(value) {
const base644 = value.replace(BASE64URL_DASH_RE, "+").replace(BASE64URL_UNDERSCORE_RE, "/");
return base644.padEnd(base644.length + (4 - base644.length % 4) % 4, "=");
}
function extractUserIdFromToken(token) {
try {
const payload = token.split(".")[1];
if (!payload) {
return "";
}
const claims = JSON.parse(decodeBase64(base64UrlToBase64(payload)));
const sub = claims["sub"];
return typeof sub === "string" && sub ? sub : "";
Low
Ai Review Evidence
The Base64 logic decodes a JWT payload and reads only its subject claim.
dist/tool-q8sxr78k.jsView on unpkg · L3551731003const url2 = `${ingestionEndpoint}/v2/track`;
const response = await fetch(url2, {
method: "POST",
headers: { "Content-Type": "application/json" },
body: JSON.stringify(payload)
});
Findings
2 High2 Medium7 Low
HighBase64 Obscured Urldist/tool-q8sxr78k.js
HighSemantic Analysis Limiteddist/index-hsadteg4.js
MediumNetwork
MediumEnvironment Vars
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
LowSuspicious Lifecycle Evidencepackage.json
LowAi Review Evidencedist/index-hsadteg4.js
LowAi Review Evidencedist/tool-q8sxr78k.js
LowAi Review Evidencedist/tool-q8sxr78k.js
Affected versions and remediation
This report applies to @uipath/vertical-solutions-tool@1.201.0.
See all versions of @uipath/vertical-solutions-tool for other recorded verdicts.
- Review the evidence and your use of @uipath/vertical-solutions-tool@1.201.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.