MAL-2026-13408

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@activepieces/piece-base44/MAL-2026-13408.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-13408
Published
2026-08-06T13:17:58Z
Modified
2026-08-06T14:34:55.287028931Z
Summary
Malicious code in @activepieces/piece-base44 (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (183bc897806f97f30cf26098efd5714de47475d007a7d5e23fe8fb05dbfe9df7)

src/index.js requires child_process and issues a ping command at line 16, with multiple POST calls at lines 13, 14, and 29 to hardcoded destinations. The pattern combines OS-level command execution with outbound HTTP POSTs from the module's top level, which is the shape of a reconnaissance and exfiltration payload rather than the piece-integration surface the package name advertises. The base44 name and the @activepieces scope also do not correspond to a known, established Activepieces piece package family, and this version's shipped code performs network I/O beyond what a normal Activepieces piece definition requires.

Database specific 
{
    "malicious-packages-origins": [
        {
            "source": "amazon-inspector",
            "id": "IN-MAL-2026-016383",
            "sha256": "183bc897806f97f30cf26098efd5714de47475d007a7d5e23fe8fb05dbfe9df7",
            "import_time": "2026-08-06T14:19:46.319692378Z",
            "modified_time": "2026-08-06T13:17:58Z",
            "versions": [
                "0.1.7"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / @activepieces/piece-base44

Package

Name
@activepieces/piece-base44
View open source insights on deps.dev
Purl
pkg:npm/%40activepieces/piece-base44

Affected ranges

Affected versions

0.*
0.1.7

Database specific

source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@activepieces/piece-base44/MAL-2026-13408.json"
cwes 
[
    {
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature."
    }
]
indicators 
{
    "evidence_files": [
        {
            "sha256": "10d469cd1863eb6d1bce5ab0ced83933e5d07d94082a2be88eb393aaeb6681e2",
            "path": "src/index.js",
            "tlsh": "ba746bd57391b17743ea61a4803f1503f379e864540c406cf6a8c9ef29acd89a2bbf79"
        }
    ],
    "package_integrity": [
        {
            "hashes": {
                "sha512_sri": "sha512-1P1b/vz1nd6c9EHbKmwnT/JYE0AomxLifSNaQo2CNG+GhTVaO+1Reof1LL56mH+rVR8r71OnYTPWYGVNtlUkFg==",
                "sha1": "84df16a0c5bd3be461928433976348c5aace3919"
            },
            "filename": "piece-base44-0.1.7.tgz"
        }
    ]
}