registry / @uipath/vertical-solutions-tool / 1.202.0
@uipath/vertical-solutions-tool@1.202.0
Scaffold and generate Vertical Solution projects.
AI Security Review
scanned 28d ago · by lpm-firewall-aiStatic review shows a normal CLI package: no preinstall, install, or postinstall, and entrypoints only register commands when the user runs them. Process spawning and network calls sit in scaffolding, browser-open, and first-party UiPath auth and telemetry paths.
Static reason
One or more suspicious static signals were detected.
Trigger
A user invoking the vertical-solutions-tool binary or importing the module.
Impact
No unconsented install-time mutation, credential theft, or remote code execution was found.
Mechanism
Command registration parses argv and performs local project scaffolding plus ordinary UiPath authentication and telemetry.
AI rationale
Static review shows a normal CLI package: no preinstall, install, or postinstall, and entrypoints only register commands when the user runs them. Process spawning and network calls sit in scaffolding, browser-open, and first-party UiPath auth and telemetry paths.
Decision evidence
public snapshotAI called this Clean at 86.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- package.json has no install lifecycle scripts and only exposes a CLI bin plus a module export.
- The bundled tool embeds the same package identity and a scaffold-and-generate description.
- child_process imports in the required bundle come from the open helper used to launch a local program.
- The bin entry builds a command and parses process.argv only when the user runs the CLI.
Evidence against
- Hardcoded Application Insights and cloud.uipath.com URLs are first-party product endpoints reached from the CLI, not install-time hooks.
- File writes are project scaffolding paths invoked by commands, not foreign agent-config mutation.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsUrlStrings
NoLicense
Source & flagged code
6 flagged · loading sourcedist/tool-wzespwbb.jsView file
8782var telemetryInstanceSlot = singleton("TelemetryService");
L8783: var DEFAULT_AI_CONNECTION_STRING = atob("[redacted]...
L8784: function getGlobalTelemetryInstance() {
High
Base64 Obscured Url
Source decodes a Base64-obscured HTTP endpoint at runtime.
dist/tool-wzespwbb.jsView on unpkg · L87826864var package_default = {
name: "@uipath/vertical-solutions-tool",
license: "SEE LICENSE IN LICENSE.txt",
version: "1.202.0",
description: "Scaffold and generate Vertical Sol
Low
Ai Review Evidence
The bundled tool embeds the same package identity and a scaffold-and-generate description.
dist/tool-wzespwbb.jsView on unpkg · L6864dist/index-h8cph72k.jsView file
•stage = ast_semantic_analysis; reason = ast_alias_growth_limit_exceeded; limitedFiles = 1
High
Findings
2 High2 Medium8 Low
HighBase64 Obscured Urldist/tool-wzespwbb.js
HighSemantic Analysis Limiteddist/index-h8cph72k.js
MediumNetwork
MediumEnvironment Vars
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
LowNo License
LowSuspicious Lifecycle Evidencepackage.json
LowAi Review Evidencedist/tool-wzespwbb.js
LowAi Review Evidencedist/index-h8cph72k.js
LowAi Review Evidencedist/index.js
Affected versions and remediation
This report applies to @uipath/vertical-solutions-tool@1.202.0.
See all versions of @uipath/vertical-solutions-tool for other recorded verdicts.
- Review the evidence and your use of @uipath/vertical-solutions-tool@1.202.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.