registry / @activepieces/piece-google-bigquery / 0.0.7
@activepieces/piece-google-bigquery@0.0.7
AI Security Review
scanned 1mo ago · by lpm-firewall-aiStatic inspection found no install-time execution, persistence, credential harvesting, or untrusted exfiltration path. Network use is limited to the declared Google authentication and BigQuery service endpoints.
Static reason
One or more suspicious static signals were detected.
Trigger
A host workflow invokes a configured BigQuery action or trigger.
Impact
Configured workflow data may be read or written in the caller's authorized BigQuery project; no unconsented behavior was found.
Mechanism
The piece uses configured Google credentials to make requests to the fixed BigQuery API.
AI rationale
Static inspection found no install-time execution, persistence, credential harvesting, or untrusted exfiltration path. Network use is limited to the declared Google authentication and BigQuery service endpoints.
Network endpoints3
bigquery.googleapis.com/bigquery/v2accounts.google.com/o/oauth2/authoauth2.googleapis.com/token
Decision evidence
public snapshotAI called this Clean at 96.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The manifest declares only src/index.js as the entrypoint and contains no lifecycle scripts or dependencies.
- The entrypoint defines Google OAuth authentication and a fixed BigQuery API base URL.
- The observed write action sends a bearer-authenticated insert request to that BigQuery API.
- The exported piece registers BigQuery actions and triggers using the same authentication configuration.
Evidence against
Behavioral surface
ChildProcessCryptoEnvironmentVarsEvalFilesystemNetworkShell
HighEntropyStringsMinifiedPossibleObfuscationUrlStrings
NoLicense
Source & flagged code
5 flaggedsrc/index.jsView file
48${h}
L49: `+await t.crypto.sha256DigestHex(P),T=await F0(t.crypto,t.securityCredentials.secretAccessKey,c,t.region,n),E=await da(t.crypto,T,b),w=`${fP} Credential=${t.securityCredentials.acc...
L50: To learn more about authentication and Google APIs, visit:
High
37`+T+"}":"{"+E.join(",")+"}",n=T,h}}o(p,"str"),typeof yv.stringify!="function"&&(yv.stringify=function(f,m,y){var P;if(n="",i="",typeof y=="number")for(P=0;P<y;P+=1)i+=" ";else type...
L38: `,r:"\r",t:" "},u,c=o(function(T){throw{name:"SyntaxError",message:T,at:r,text:u}},"error"),l=o(function(T){return T&&T!==n&&c("Expected '"+T+"' instead of '"+n+"'"),n=u.charAt(r),...
L39: Supported algorithms are:
...
L48: ${h}
L49: `+await t.crypto.sha256DigestHex(P),T=await F0(t.crypto,t.securityCredentials.secretAccessKey,c,t.region,n),E=await da(t.crypto,T,b),w=`${fP} Credential=${t.securityCredentials.acc...
L50: To learn more about authentication and Google APIs, visit:
High
Same File Env Network Execution
A single source file combines environment access, network access, and code or shell execution; review context before blocking.
src/index.jsView on unpkg · L3737
Findings
6 High3 Medium5 Low
HighChild Processsrc/index.js
HighShell
HighSame File Env Network Executionsrc/index.js
HighCommand Output Exfiltrationsrc/index.js
HighCloud Metadata Accesssrc/index.js
HighTrigger Reachable Command Output Exfiltrationsrc/index.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowEval
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
LowNo License
Affected versions and remediation
This report applies to @activepieces/piece-google-bigquery@0.0.7.
See all versions of @activepieces/piece-google-bigquery for other recorded verdicts.
- Review the evidence and your use of @activepieces/piece-google-bigquery@0.0.7 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.