registry / Credential exfiltration / base44
base44
Base44 CLI - Unified interface for managing Base44 applications
This report shows the evidence for base44@0.2.6. 1 of 25 known versions is blocked or flagged. The newest version, 0.2.7, is flagged. See all versions.
AI Security Review
scanned 6d ago · by lpm-firewall-aiBy default, command failures send unredacted command options to the package’s telemetry host, and the CLI exposes a one-time import credential as an option. This creates a concrete credential disclosure path when a command fails.
Static reason
One or more suspicious static signals were detected.
Trigger
A CLI command fails while telemetry is enabled, which is the default.
Impact
A one-time import credential may be disclosed to the telemetry host.
Mechanism
The CLI records command arguments and options in exception properties and submits the exception to PostHog without redacting the --token value.
Attack narrative
The CLI accepts a one-time import key through --token. Before running a command it records the command arguments and options; if an exception occurs, it sends those properties with exception telemetry to us.i.posthog.com. Telemetry is enabled by default, and the captured option is not redacted, so a failed import can disclose the key to the telemetry service.
AI rationale
By default, command failures send unredacted command options to the package’s telemetry host, and the CLI exposes a one-time import credential as an option. This creates a concrete credential disclosure path when a command fails.
Evidence
dist/cli/index.js
Network endpoints1
us.i.posthog.com
Decision evidence
public snapshotAI called this Malicious at 95.0% confidence as Malware with low false-positive risk.
Evidence for block
- The executable starts the CLI, which sends exception telemetry to https://us.i.posthog.com by default; telemetry is disabled only when BASE44_DISABLE_TELEMETRY=1.
- Exception telemetry includes command arguments and options without redaction.
- The CLI accepts a one-time import key through the --token option, so a command failure can expose that credential in telemetry.
- The CLI captures exceptions during command parsing and sends them with the collected properties.
Evidence against
- The manifest declares no install, preinstall, or postinstall hooks.
- The package is presented as a CLI for managing Base44 applications, and its normal API traffic is consistent with that purpose.
Behavioral surface
DynamicRequireEnvironmentVarsFilesystemNetwork
HighEntropyStringsTelemetryUrlStrings
Source & flagged code
4 flaggeddist/assets/backend-runtime/main.tsView file
148try {
L149: functionModule = await import(functionPath);
L150: } catch (error) {
Medium
Dynamic Require
Package source references dynamic require/import behavior.
dist/assets/backend-runtime/main.tsView on unpkg · L148dist/cli/index.jsView file
284106// src/cli/telemetry/consts.ts
var POSTHOG_API_KEY = "phc_VsHW5HxTzpORanESQh9A08tmZLQkKbtIBTYoQvRpPOp";
var TELEMETRY_DISABLED_ENV_VAR = "BASE44_DISABLE_TELEMETRY";
var POSTHOG_REQUEST_TIMEOUT_MS = 1000;
// src/cli/telemetry/posthog.ts
var client = null;
function isTelemetryEnabled() {
return process.env[TELEMETRY_DISABLED_ENV_VAR] !== "1";
}
function getPostHogClient() {
if (!isTelemetryEnabled()) {
return null;
}
if (!client) {
try {
High
Ai Review Evidence
The executable starts the CLI, which sends exception telemetry to https://us.i.posthog.com by default; telemetry is disabled only when BASE44_DISABLE_TELEMETRY=1.
dist/cli/index.jsView on unpkg · L284106Findings
1 High6 Medium5 Low
HighAi Review Evidencedist/cli/index.js
MediumDynamic Requiredist/assets/backend-runtime/main.ts
MediumNetwork
MediumEnvironment Vars
MediumOversized Source Filedist/cli/index.js
MediumStructural Risk Force Deep Review
MediumRemote Tarball Dependencypackage.json
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowTelemetry
LowUrl Strings
Affected versions and remediation
This report applies to base44@0.2.6.
The versions list below shows the verdict for each recorded version.
- Avoid installing base44@0.2.6. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.