{
  "affected": [
    {
      "database_specific": {
        "cwes": [
          {
            "cweId": "CWE-506",
            "description": "The product contains code that appears to be malicious in nature.",
            "name": "Embedded Malicious Code"
          }
        ],
        "indicators": {
          "evidence_files": [
            {
              "path": "src/index.js",
              "sha256": "10d469cd1863eb6d1bce5ab0ced83933e5d07d94082a2be88eb393aaeb6681e2",
              "tlsh": "ba746bd57391b17743ea61a4803f1503f379e864540c406cf6a8c9ef29acd89a2bbf79"
            }
          ],
          "package_integrity": [
            {
              "filename": "piece-base44-0.1.7.tgz",
              "hashes": {
                "sha1": "84df16a0c5bd3be461928433976348c5aace3919",
                "sha512_sri": "sha512-1P1b/vz1nd6c9EHbKmwnT/JYE0AomxLifSNaQo2CNG+GhTVaO+1Reof1LL56mH+rVR8r71OnYTPWYGVNtlUkFg=="
              }
            }
          ]
        }
      },
      "package": {
        "ecosystem": "npm",
        "name": "@activepieces/piece-base44"
      },
      "versions": [
        "0.1.7"
      ]
    }
  ],
  "credits": [
    {
      "contact": [
        "inspector-research@amazon.com"
      ],
      "name": "Amazon Inspector",
      "type": "FINDER"
    }
  ],
  "database_specific": {
    "malicious-packages-origins": [
      {
        "id": "IN-MAL-2026-016383",
        "import_time": "2026-08-06T14:19:46.319692378Z",
        "modified_time": "2026-08-06T13:17:58Z",
        "sha256": "183bc897806f97f30cf26098efd5714de47475d007a7d5e23fe8fb05dbfe9df7",
        "source": "amazon-inspector",
        "versions": [
          "0.1.7"
        ]
      }
    ]
  },
  "details": "\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (183bc897806f97f30cf26098efd5714de47475d007a7d5e23fe8fb05dbfe9df7)\nsrc/index.js requires child_process and issues a ping command at line 16, with multiple POST calls at lines 13, 14, and 29 to hardcoded destinations. The pattern combines OS-level command execution with outbound HTTP POSTs from the module\u0027s top level, which is the shape of a reconnaissance and exfiltration payload rather than the piece-integration surface the package name advertises. The base44 name and the @activepieces scope also do not correspond to a known, established Activepieces piece package family, and this version\u0027s shipped code performs network I/O beyond what a normal Activepieces piece definition requires.\n",
  "id": "MAL-2026-13408",
  "modified": "2026-08-06T13:17:58Z",
  "published": "2026-08-06T13:17:58Z",
  "references": [
    {
      "type": "PACKAGE",
      "url": "https://www.npmjs.com/package/@activepieces/piece-base44/v/0.1.7"
    }
  ],
  "schema_version": "1.7.4",
  "summary": "Malicious code in @activepieces/piece-base44 (npm)"
}