@activepieces/piece-google-contacts
This report shows the evidence for @activepieces/piece-google-contacts@0.4.8. 2 of 10 known versions are blocked or flagged. The newest version, 0.6.0, is flagged. See all versions.
OpenSSF/OSV Malicious Advisory
imported 3mo ago · by OpenSSF/OSVOpenSSF/OSV advisory MAL-2026-13395 confirms this npm version as malicious.
Advisory
MAL-2026-13395
Source
OpenSSF Malicious Packages via OSV
Summary
Malicious code in @activepieces/piece-google-contacts (npm)
Details
src/index.js imports child_process and issues POST requests alongside a ping command invocation (lines 25, 38, 49). The co-occurrence of child_process shell execution with hardcoded network POST endpoints and a system ping in a package presenting itself as a Google Contacts integration piece is inconsistent with the declared purpose (an OAuth-based Google Contacts API client would not need to spawn shell processes or ping remote hosts). The pattern matches host reconnaissance and outbound beaconing shape rather than legitimate Google People API interaction.
References
Independent scan evidence
public snapshotBehavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetwork
HighEntropyStringsMinifiedObfuscatedProtestwareUrlStrings
NoLicense
Source & flagged code
5 flaggedsrc/index.jsView file
48${g}
L49: `+await t.crypto.sha256DigestHex(h),T=await cz(t.crypto,t.securityCredentials.secretAccessKey,c,t.region,n),P=await wa(t.crypto,T,y),x=`${CE} Credential=${t.securityCredentials.acc...
L50: To learn more about authentication and Google APIs, visit:
High
37`+T+"}":"{"+P.join(",")+"}",n=T,g}}o(l,"str"),typeof zP.stringify!="function"&&(zP.stringify=function(p,f,_){var h;if(n="",i="",typeof _=="number")for(h=0;h<_;h+=1)i+=" ";else type...
L38: `,r:"\r",t:" "},s,c=o(function(T){throw{name:"SyntaxError",message:T,at:r,text:s}},"error"),d=o(function(T){return T&&T!==n&&c("Expected '"+T+"' instead of '"+n+"'"),n=s.charAt(r),...
L39: Supported algorithms are:
...
L48: ${g}
L49: `+await t.crypto.sha256DigestHex(h),T=await cz(t.crypto,t.securityCredentials.secretAccessKey,c,t.region,n),P=await wa(t.crypto,T,y),x=`${CE} Credential=${t.securityCredentials.acc...
L50: To learn more about authentication and Google APIs, visit:
High
Same File Env Network Execution
A single source file combines environment access, network access, and code or shell execution; review context before blocking.
src/index.jsView on unpkg · L3737
Findings
5 High4 Medium5 Low
HighChild Processsrc/index.js
HighSame File Env Network Executionsrc/index.js
HighCommand Output Exfiltrationsrc/index.js
HighCloud Metadata Accesssrc/index.js
HighTrigger Reachable Command Output Exfiltrationsrc/index.js
MediumNetwork
MediumEnvironment Vars
MediumProtestware
MediumStructural Risk Force Deep Review
LowFilesystem
LowObfuscated
LowHigh Entropy Strings
LowUrl Strings
LowNo License
Affected versions and remediation
This report applies to @activepieces/piece-google-contacts@0.4.8.
The versions list below shows the verdict for each recorded version.
- Avoid installing @activepieces/piece-google-contacts@0.4.8. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Source advisory published: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.