registry / @uipath/vertical-solutions-tool / 1.202.1
@uipath/vertical-solutions-tool@1.202.1
Scaffold and generate Vertical Solution projects.
AI Security Review
scanned 28d ago · by lpm-firewall-aiStatic inspection found a user-invoked project CLI without lifecycle hooks or a concrete malicious chain. Network behavior is bounded telemetry rather than credential forwarding or payload delivery.
Static reason
One or more suspicious static signals were detected.
Trigger
A user runs one of the CLI commands.
Impact
No install-time execution, credential theft, persistence, destructive action, or unconsented control-surface mutation was identified.
Mechanism
Commands create or update project configuration, and telemetry sends JSON events to the configured ingestion endpoint.
AI rationale
Static inspection found a user-invoked project CLI without lifecycle hooks or a concrete malicious chain. Network behavior is bounded telemetry rather than credential forwarding or payload delivery.
Evidence
vss.json
Network endpoints1
westeurope-5.in.applicationinsights.azure.com
Decision evidence
public snapshotAI called this Clean at 91.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The manifest exposes module and CLI entry points and contains no install lifecycle hook.
- The init command writes only a vss.json project configuration after an explicit command invocation.
- The tool registers init, sync, add, and generate commands.
- The bundled browser helper validates its target type before delegation.
- Telemetry posts JSON events to its configured Application Insights ingestion endpoint during tool use.
Evidence against
Behavioral surface
ChildProcessCryptoEnvironmentVarsEvalFilesystemNetwork
HighEntropyStringsUrlStrings
NoLicense
Source & flagged code
5 flagged · loading sourcedist/tool-vf45zw6x.jsView file
8782var telemetryInstanceSlot = singleton("TelemetryService");
L8783: var DEFAULT_AI_CONNECTION_STRING = atob("[redacted]...
L8784: function getGlobalTelemetryInstance() {
High
Base64 Obscured Url
Source decodes a Base64-obscured HTTP endpoint at runtime.
dist/tool-vf45zw6x.jsView on unpkg · L878244183the vertical solution",
default: "My App"
});
const config3 = {
appName: projectName,
processes: [],
connections: []
};
const [writeError] = await catchError(fs2.writeFile(configPath, JSON.stringify(config3, null, 2)));
if (writeErro
Low
Ai Review Evidence
The init command writes only a vss.json project configuration after an explicit command invocation.
dist/tool-vf45zw6x.jsView on unpkg · L4418344308l Solution projects.",
commandPrefix: "vss"
};
var registerCommands = async (program2) => {
registerInitCommand(program2);
registerSyncCommand(program2);
registerAddCommand(program2);
registerGenerateCommand(program2);
};
export { Command,
Low
Ai Review Evidence
The tool registers init, sync, add, and generate commands.
Findings
2 High2 Medium8 Low
HighBase64 Obscured Urldist/tool-vf45zw6x.js
HighSemantic Analysis Limiteddist/index-h8cph72k.js
MediumNetwork
MediumEnvironment Vars
LowEval
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
LowNo License
LowSuspicious Lifecycle Evidencepackage.json
LowAi Review Evidencedist/tool-vf45zw6x.js
LowAi Review Evidencedist/tool-vf45zw6x.js
Affected versions and remediation
This report applies to @uipath/vertical-solutions-tool@1.202.1.
See all versions of @uipath/vertical-solutions-tool for other recorded verdicts.
- Review the evidence and your use of @uipath/vertical-solutions-tool@1.202.1 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.