base44@0.1.14
Base44 CLI - Unified interface for managing Base44 applications
AI Security Review
scanned 2mo ago · by lpm-firewall-aiThis is a lifecycle-free CLI package whose risky primitives support explicit development and script-execution features. Error telemetry is a privacy consideration, but the inspected source does not establish malicious behavior.
Static reason
One or more suspicious static signals were detected.
Trigger
A user invokes a Base44 CLI command.
Impact
No unconsented install-time execution, persistence, or secret exfiltration was confirmed.
Mechanism
User-invoked CLI telemetry and development tooling.
AI rationale
This is a lifecycle-free CLI package whose risky primitives support explicit development and script-execution features. Error telemetry is a privacy consideration, but the inspected source does not establish malicious behavior.
Decision evidence
public snapshotAI called this Clean at 91.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The CLI sends error telemetry, including command arguments, current directory, platform details, and API error fields, to PostHog unless disabled.
- The development wrapper dynamically imports the configured user function, and the exec command runs user-supplied script code with an authenticated SDK client.
- The manifest exposes a CLI binary and contains no npm preinstall, install, or postinstall lifecycle hook.
Evidence against
- No install-time execution or persistence mechanism is declared.
- Dynamic imports and subprocesses are restricted to explicit CLI development and exec workflows.
- No package code harvests local files or sends environment secrets to an unrelated endpoint.
Behavioral surface
DynamicRequireEnvironmentVarsFilesystemNetwork
HighEntropyStringsTelemetryUrlStrings
Source & flagged code
4 flaggeddist/assets/backend-runtime/main.tsView file
148try {
L149: functionModule = await import(functionPath);
L150: } catch (error) {
Medium
Dynamic Require
Package source references dynamic require/import behavior.
dist/assets/backend-runtime/main.tsView on unpkg · L148dist/cli/index.jsView file
•path = dist/cli/index.js
kind = oversized_source_file
sizeBytes = 10830970
magicHex = [redacted]
Medium
Oversized Source File
Package contains source files above the normal full-analysis size ceiling.
dist/cli/index.jsView on unpkg268710const apiProps = error48 instanceof ApiError ? {
api_status_code: error48.statusCode,
api_request_url: error48.requestUrl,
api_request_method: error48.requestMethod,
api_request_body: error48.requestBody,
api_response_body: error48.responseBody,
api_request_id: error48.requestId
} : {};
Findings
6 Medium6 Low
MediumDynamic Requiredist/assets/backend-runtime/main.ts
MediumNetwork
MediumEnvironment Vars
MediumOversized Source Filedist/cli/index.js
MediumStructural Risk Force Deep Review
MediumRemote Tarball Dependencypackage.json
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowTelemetry
LowUrl Strings
LowAi Review Evidencedist/cli/index.js
Affected versions and remediation
This report applies to base44@0.1.14.
See all versions of base44 for other recorded verdicts.
- Review the evidence and your use of base44@0.1.14 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.