base44@0.1.8
Base44 CLI - Unified interface for managing Base44 applications
AI Security Review
scanned 3mo ago · by lpm-firewall-aiNo concrete malicious behavior or unconsented install-time control-surface mutation was found. The default, user-invoked agent-skills bootstrap is a guarded first-party extension lifecycle risk and warrants warning rather than blocking.
Static reason
One or more suspicious static signals were detected.
Trigger
User runs `base44 create` or `base44 scaffold` without `--no-skills`; separately, user pipes code to `base44 exec`.
Impact
A compromised external skills package or supplied script could modify the user project or act with the granted runtime permissions.
Mechanism
User-invoked project setup installs agent skills; explicit CLI execution runs supplied scripts.
AI rationale
No concrete malicious behavior or unconsented install-time control-surface mutation was found. The default, user-invoked agent-skills bootstrap is a guarded first-party extension lifecycle risk and warrants warning rather than blocking.
Evidence
package.jsonbin/run.jsdist/cli/index.jsdist/assets/backend-runtime/main.tsdist/assets/backend-runtime/exec.ts
Decision evidence
public snapshotAI called this Suspicious at 86.0% confidence as Benign with medium false-positive risk.
Evidence for warning
- dist/cli/index.js: `create`/`scaffold` invoke `npx -y skills add base44/skills -y` unless `--no-skills` is supplied.
- That command runs with `shell: true` in the newly created project directory.
- dist/cli/index.js: `exec` deliberately runs stdin-provided scripts under Deno with `--allow-all` and a Base44 token.
Evidence against
- package.json has no preinstall, install, or postinstall lifecycle hook.
- bin/run.js only imports and starts the CLI; install does not execute it.
- Agent-skill installation is reached only after an explicit `base44 create` or `base44 scaffold` command.
- Dynamic imports in dist/assets/backend-runtime load user-selected function/script paths for documented local development.
- No package code reads SSH/browser credential stores or sends harvested environment values to an untrusted endpoint.
Behavioral surface
ChildProcessDynamicRequireEnvironmentVarsFilesystemNetwork
Source & flagged code
3 flaggeddist/assets/backend-runtime/main.tsView file
148try {
L149: functionModule = await import(functionPath);
L150: } catch (error) {
Medium
Dynamic Require
Package source references dynamic require/import behavior.
dist/assets/backend-runtime/main.tsView on unpkg · L148dist/cli/index.jsView file
•path = dist/cli/index.js
kind = oversized_source_file
sizeBytes = 10796148
magicHex = [redacted]
Medium
Oversized Source File
Package contains source files above the normal full-analysis size ceiling.
dist/cli/index.jsView on unpkgpackage.jsonView file
•Remote tarball dependency specs: @deno/loader@https://npm.jsr.io/~/11/@jsr/deno__loader/0.5.0.tgz
Findings
6 Medium5 Low
MediumDynamic Requiredist/assets/backend-runtime/main.ts
MediumNetwork
MediumEnvironment Vars
MediumOversized Source Filedist/cli/index.js
MediumStructural Risk Force Deep Review
MediumRemote Tarball Dependencypackage.json
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowTelemetry
LowUrl Strings
Affected versions and remediation
This report applies to base44@0.1.8.
See all versions of base44 for other recorded verdicts.
- Review the evidence and your use of base44@0.1.8 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.