base44@0.1.17
Base44 CLI - Unified interface for managing Base44 applications
AI Security Review
scanned 27d ago · by lpm-firewall-aiInspected source shows a CLI launcher, a user-function runtime import, Base44 service configuration, and opt-out PostHog telemetry. The scanner signals do not establish malicious behavior or an attack surface.
Static reason
One or more suspicious static signals were detected.
Trigger
The user invokes the `base44` CLI or runs a local function.
Impact
No concrete malicious effect was established from the inspected source.
Mechanism
The launcher starts the CLI; the runtime imports the configured function module. API requests use the Base44 service by default, and telemetry has a disable flag.
AI rationale
Inspected source shows a CLI launcher, a user-function runtime import, Base44 service configuration, and opt-out PostHog telemetry. The scanner signals do not establish malicious behavior or an attack surface.
Evidence
package.jsonbin/run.jsdist/cli/index.jsdist/assets/backend-runtime/main.ts
Network endpoints2
app.base44.comus.i.posthog.com
Decision evidence
public snapshotAI called this Clean at 84.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The manifest exposes a CLI entrypoint and declares no install lifecycle hook.
- The launcher imports and runs the CLI when invoked.
- API configuration defaults to Base44’s service endpoint; telemetry is sent to PostHog and can be disabled with an environment flag.
- The flagged dynamic import loads the user-selected function as part of the local runtime wrapper.
Evidence against
Behavioral surface
DynamicRequireEnvironmentVarsFilesystemNetwork
HighEntropyStringsTelemetryUrlStrings
Oversized source lightweight scan
dist/cli/index.js10.3 MB file, sampled 256 KB
Source & flagged code
4 flaggeddist/assets/backend-runtime/main.tsView file
148try {
L149: functionModule = await import(functionPath);
L150: } catch (error) {
Medium
Dynamic Require
Package source references dynamic require/import behavior.
dist/assets/backend-runtime/main.tsView on unpkg · L148dist/cli/index.jsView file
•path = dist/cli/index.js
kind = oversized_source_file
sizeBytes = 10849546
magicHex = [redacted]
Medium
Oversized Source File
Package contains source files above the normal full-analysis size ceiling.
dist/cli/index.jsView on unpkgpackage.jsonView file
•Remote tarball dependency specs: @deno/loader@https://npm.jsr.io/~/11/@jsr/deno__loader/0.5.0.tgz
Findings
6 Medium6 Low
MediumDynamic Requiredist/assets/backend-runtime/main.ts
MediumNetwork
MediumEnvironment Vars
MediumOversized Source Filedist/cli/index.js
MediumStructural Risk Force Deep Review
MediumRemote Tarball Dependencypackage.json
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowTelemetry
LowUrl Strings
LowSuspicious Lifecycle Evidencepackage.json
Affected versions and remediation
This report applies to base44@0.1.17.
See all versions of base44 for other recorded verdicts.
- Review the evidence and your use of base44@0.1.17 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.