base44@0.2.7
Base44 CLI - Unified interface for managing Base44 applications
AI Security Review
scanned 4d ago · by lpm-firewall-aiThe CLI sends runtime error telemetry to PostHog without a consent prompt, and the payload includes identifying details and API error bodies. This is suspicious telemetry; the provided opt-out does not make the default collection disclosed or consented.
Static reason
One or more suspicious static signals were detected.; source fingerprint signature matched known malicious package; routed for review
Trigger
Starting the CLI registers handlers; telemetry is sent when an exception is reported.
Impact
Command details, user identity, local context, and API error request or response bodies may leave the user's environment.
Mechanism
The CLI captures exceptions and sends their properties to https://us.i.posthog.com. Telemetry is enabled unless BASE44_DISABLE_TELEMETRY=1.
AI rationale
The CLI sends runtime error telemetry to PostHog without a consent prompt, and the payload includes identifying details and API error bodies. This is suspicious telemetry; the provided opt-out does not make the default collection disclosed or consented.
Evidence
dist/cli/index.js
Network endpoints1
us.i.posthog.com
Decision evidence
public snapshotAI called this Suspicious at 94.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The CLI sends error telemetry to PostHog by default; telemetry can be disabled with BASE44_DISABLE_TELEMETRY=1.
- Reported errors may include the user's email and name, command arguments and options, app ID, and API request and response bodies.
- Exception reporting is registered when the CLI starts and also runs for uncaught exceptions, unhandled rejections, and command parse errors.
Evidence against
- The package declares no install, preinstall, or postinstall hook.
- The telemetry is tied to error reporting, and the package provides an environment variable to disable it.
Behavioral surface
DynamicRequireEnvironmentVarsFilesystemNetwork
HighEntropyStringsTelemetryUrlStrings
Source & flagged code
4 flaggeddist/assets/backend-runtime/main.tsView file
148try {
L149: functionModule = await import(functionPath);
L150: } catch (error) {
Medium
Dynamic Require
Package source references dynamic require/import behavior.
dist/assets/backend-runtime/main.tsView on unpkg · L148dist/cli/index.jsView file
•path = dist/cli/index.js
kind = oversized_source_file
sizeBytes = 11365456
magicHex = [redacted]
Medium
Oversized Source File
Package contains source files above the normal full-analysis size ceiling.
dist/cli/index.jsView on unpkgpackage.jsonView file
•Remote tarball dependency specs: @deno/loader@https://npm.jsr.io/~/11/@jsr/deno__loader/0.5.0.tgz
Findings
1 High6 Medium5 Low
HighKnown Malware Source Fingerprint Signaturebin/binary-entry.ts
MediumDynamic Requiredist/assets/backend-runtime/main.ts
MediumNetwork
MediumEnvironment Vars
MediumOversized Source Filedist/cli/index.js
MediumStructural Risk Force Deep Review
MediumRemote Tarball Dependencypackage.json
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowTelemetry
LowUrl Strings
Affected versions and remediation
This report applies to base44@0.2.7.
See all versions of base44 for other recorded verdicts.
- Review the evidence and your use of base44@0.2.7 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.