MAL-2026-13394
Malicious code in @activepieces/piece-google-bigquery (npm)
Details
--- _-= Per source details. Do not edit below this line.=-_
## Source: amazon-inspector (acc3321f587f5a8efea8256aeb935a905df2da5f5a901cd8f7355a75e3832da3) The package presents itself as an Activepieces connector for Google BigQuery but src/index.js combines require("child_process"), an OS reconnaissance command (ping), and multiple POST calls to an external endpoint at module load. This is the network-command-exfiltration + hardcoded-C2 shape rather than a BigQuery client: a legitimate BigQuery piece would call googleapis / @google-cloud/bigquery, not shell out and POST host data to an unrelated destination. Loading the module therefore executes attacker-controlled behavior against the installer's host with no relation to the advertised BigQuery functionality.
Are you affected?
Enter the version of the package you're using.
Affected packages
No fixed version published yet for @activepieces/piece-google-bigquery (npm). Pin to a known-safe version or switch to an alternative.