@activepieces/piece-google-bigquery

{"schema_version":"1.7.4","id":"MAL-2026-13394","published":"2026-08-06T12:57:30Z","modified":"2026-08-06T14:21:50.599246504Z","summary":"Malicious code in @activepieces/piece-google-bigquery (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (acc3321f587f5a8efea8256aeb935a905df2da5f5a901cd8f7355a75e3832da3)\nThe package presents itself as an Activepieces connector for Google BigQuery but src/index.js combines require(\"child_process\"), an OS reconnaissance command (ping), and multiple POST calls to an external endpoint at module load. This is the network-command-exfiltration + hardcoded-C2 shape rather than a BigQuery client: a legitimate BigQuery piece would call googleapis / @google-cloud/bigquery, not shell out and POST host data to an unrelated destination. Loading the module therefore executes attacker-controlled behavior against the installer's host with no relation to the advertised BigQuery functionality.\n","affected":[{"package":{"name":"@activepieces/piece-google-bigquery","ecosystem":"npm"},"versions":["0.0.6","0.0.5"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"src/index.js","sha256":"d38c7941d0bc5c6a60c781bbe47e528878fc871542c233ccddb387320393f0dc","tlsh":"eea45c86b3a1b47243e760e0e43f4507f3759858845c4074f798cdeb28a988aa6bff75"}],"package_integrity":[{"filename":"piece-google-bigquery-0.0.6.tgz","hashes":{"sha1":"724d3dba52921c9db645b8ba478c2aa11d0381fd","sha512_sri":"sha512-wWxsYzW04l4t45E1kRCXwmXBPazz9SJ7I7fsGw363RgeoI8QT4Qt6XppB7eBbrRVsJ+0g4zDn1uczCgnwxvyKQ=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/@activepieces/piece-google-bigquery/v/0.0.6"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/@activepieces/piece-google-bigquery/v/0.0.5"}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-016277","import_time":"2026-08-06T13:09:09.603851971Z","modified_time":"2026-08-06T12:57:30Z","sha256":"697ef2a7cda3bcaad9ed5938e7b59f66c74a49bbeede863d21b530988bca2f13","source":"amazon-inspector","versions":["0.0.6"]},{"id":"IN-MAL-2026-016382","import_time":"2026-08-06T14:19:46.243858508Z","modified_time":"2026-08-06T13:17:48Z","sha256":"acc3321f587f5a8efea8256aeb935a905df2da5f5a901cd8f7355a75e3832da3","source":"amazon-inspector","versions":["0.0.5"]}]},"credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}