@activepieces/piece-base44

{"modified":"2026-08-06T13:17:58Z","published":"2026-08-06T13:17:58Z","schema_version":"1.7.4","id":"MAL-2026-13408","summary":"Malicious code in @activepieces/piece-base44 (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (183bc897806f97f30cf26098efd5714de47475d007a7d5e23fe8fb05dbfe9df7)\nsrc/index.js requires child_process and issues a ping command at line 16, with multiple POST calls at lines 13, 14, and 29 to hardcoded destinations. The pattern combines OS-level command execution with outbound HTTP POSTs from the module's top level, which is the shape of a reconnaissance and exfiltration payload rather than the piece-integration surface the package name advertises. The base44 name and the @activepieces scope also do not correspond to a known, established Activepieces piece package family, and this version's shipped code performs network I/O beyond what a normal Activepieces piece definition requires.\n","affected":[{"package":{"ecosystem":"npm","name":"@activepieces/piece-base44"},"versions":["0.1.7"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"src/index.js","sha256":"10d469cd1863eb6d1bce5ab0ced83933e5d07d94082a2be88eb393aaeb6681e2","tlsh":"ba746bd57391b17743ea61a4803f1503f379e864540c406cf6a8c9ef29acd89a2bbf79"}],"package_integrity":[{"filename":"piece-base44-0.1.7.tgz","hashes":{"sha1":"84df16a0c5bd3be461928433976348c5aace3919","sha512_sri":"sha512-1P1b/vz1nd6c9EHbKmwnT/JYE0AomxLifSNaQo2CNG+GhTVaO+1Reof1LL56mH+rVR8r71OnYTPWYGVNtlUkFg=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/@activepieces/piece-base44/v/0.1.7"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-016383","import_time":"2026-08-06T14:19:46.319692378Z","modified_time":"2026-08-06T13:17:58Z","sha256":"183bc897806f97f30cf26098efd5714de47475d007a7d5e23fe8fb05dbfe9df7","source":"amazon-inspector","versions":["0.1.7"]}]}}