OpenSSF/OSV advisory MAL-2026-13394 confirms this npm version as malicious. The package presents itself as an Activepieces connector for Google BigQuery but src/index.js combines require("child_process"), an OS reconnaissance command (ping), and multiple POST calls to an external endpoint at module load...
Source
OpenSSF Malicious Packages via OSV
Summary
Malicious code in @activepieces/piece-google-bigquery (npm)
Details
The package presents itself as an Activepieces connector for Google BigQuery but src/index.js combines require("child_process"), an OS reconnaissance command (ping), and multiple POST calls to an external endpoint at module load. This is the network-command-exfiltration + hardcoded-C2 shape rather than a BigQuery client: a legitimate BigQuery piece would call googleapis / @google-cloud/bigquery, not shell out and POST host data to an unrelated destination. Loading the module therefore executes attacker-controlled behavior against the installer's host with no relation to the advertised BigQuery functionality.
Decision reason
OpenSSF Malicious Packages via OSV confirms @activepieces/piece-google-bigquery@0.0.5 as malicious (MAL-2026-13394): Malicious code in @activepieces/piece-google-bigquery (npm)