The npm package @activepieces/piece-base44 version 0.1.7 contains malicious code that executes OS-level commands and performs unauthorized network communication. Specifically, the package's src/index.js file executes a ping command and makes multiple HTTP POST requests to hardcoded external destinations. This behavior is inconsistent with the expected functionality of an Activepieces integration and indicates reconnaissance and data exfiltration activity. There is no known patch or fix available for this version. No active exploits have been reported in the wild.