The @activepieces/piece-base44 npm package at version 0.1.7 includes malicious code embedded in its src/index.js file. The code requires the child_process module to execute an OS-level ping command and issues multiple outbound HTTP POST requests to hardcoded URLs. This combination of command execution and network communication at the module's top level suggests the package is performing reconnaissance and exfiltration rather than legitimate piece integration functions. The package name and scope do not align with known Activepieces official packages, indicating it is likely a malicious or typosquatting package. No patch or remediation information is available.

The malicious code can execute arbitrary OS commands and send data to external servers without user consent, potentially leading to system compromise, data leakage, or further malicious activity. Since the package runs this code upon inclusion, any project depending on this version is at risk of unauthorized information disclosure and system manipulation.

No official patch or remediation is currently available for this malicious package version. Users should immediately remove @activepieces/piece-base44 version 0.1.7 from their dependencies and avoid installing packages from untrusted or suspicious sources. Verify package authenticity before inclusion and monitor for updates from the official Activepieces project or trusted repositories.