@activepieces/piece-google-contacts@0.4.8: Malicious npm security

Loading npm security reports…

@activepieces/piece-google-contacts@0.4.8: Malicious npm security | LPM Firewall

Source & flagged code

5 flagged

Lines 1-68javascript

1"use strict";var tw=Object.create;var Ii=Object.defineProperty;var rw=Object.getOwnPropertyDescriptor;var nw=Object.getOwnPropertyNames;var ow=Object.getPrototypeOf,iw=Object.prototype.hasOwnProperty;var o=(t,e)=>Ii(t,"name",{value:e,configurable:!0});var gt=(t,e,r)=>()=>{if(r)throw r[0];try{return t&&(e=t(t=0)),e}catch(n){throw r=[n],n}};var k=(t,e)=>()=>{try{return e||t((e={exports:{}}).exports,e),e.exports}catch(r){throw e=0,r}},gs=(t,e)=>{for(var r in e)Ii(t,r,{get:e[r],enumerable:!0})},hh=(t,e,r,n)=>{if(e&&typeof e=="object"||typeof e=="function")for(let i of nw(e))!iw.call(t,i)&&i!==r&&I ...

2`;Ue.DEFAULT_CONTENT_TYPE="application/octet-stream";Ue.prototype.append=function(t,e,r){r=r||{},typeof r=="string"&&(r={filename:r});var n=cd.prototype.append.bind(this);if((typeof e=="number"||e==null)&&(e=String(e)),Array.isArray(e)){this._error(new Error("Arrays are not supported."));return}var i=this._multiPartHeader(t,e,r),s=this._multiPartFooter();n(i),n(e),n(s),this._trackLength(i,e,r)};Ue.prototype._trackLength=function(t,e,r){var n=0;r.knownLength!=null?n+=Number(r.knownLength):Buffer.isBuffer(e)?n=e.length:typeof e=="string"&&(n=Buffer.byteLength(e)),this._valueLength+=n,this._overh ...

3`)||n,code:s,status:i},e.data.error)}return Object.assign({message:n,code:s,status:i},e.data.error)}}return{message:n,code:e.status,status:e.statusText}}};er.GaxiosError=dd;function LC(t,e){switch(t){case"stream":return e;case"json":return

4`).join(`

5`+s),t.push(i+"m+"+tu.exports.humanize(this.diff)+"\x1B[0m")}else t[0]=s0()+e+" "+t[0]}o(a0,"formatArgs");function s0(){return vt.inspectOpts.hideDate?"":new Date().toISOString()+" "}o(s0,"getDate");function u0(...t){return process.stderr.write(eu.formatWithOptions(vt.inspectOpts,...t)+`

6`)}o(u0,"log");function c0(t){t?process.env.DEBUG=t:delete process.env.DEBUG}o(c0,"save");function l0(){return process.env.DEBUG}o(l0,"load");function d0(t){t.inspectOpts={};let e=Object.keys(vt.inspectOpts);for(let r=0;r<e.length;r++)t.inspectOpts[e[r]]=vt.inspectOpts[e[r]]}o(d0,"init");tu.exports=gd()(vt);var{formatters:vb}=tu.exports;vb.o=function(t){return this.inspectOpts.colors=this.useColors,eu.inspect(t,this.inspectOpts).split(`

7`).map(e=>e.trim()).join(" ")};vb.O=function(t){return this.inspectOpts.colors=this.useColors,eu.inspect(t,this.inspectOpts)}});var bd=k((L8,vd)=>{typeof process>"u"||process.type==="renderer"||process.browser===!0||process.__nwjs?vd.exports=fb():vd.exports=bb()});var Eb=k(Ct=>{"use strict";var p0=Ct&&Ct.__createBinding||(Object.create?(function(t,e,r,n){n===void 0&&(n=r);var i=Object.getOwnPropertyDescriptor(e,r);(!i||("get"in i?!e.__esModule:i.writable||i.configurable))&&(i={enumerable:!0,get:o(function(){return e[r]},"get")}),Object.defineProperty(t,n,i)}):(function(t,e,r,n){n===void 0&&(n= ...

8`).some(n=>n.indexOf("(https.js:")!==-1||n.indexOf("node:https:")!==-1)}incrementSockets(e){if(this.maxSockets===1/0&&this.maxTotalSockets===1/0)return null;this.sockets[e]||(this.sockets[e]=[]);let r=new b0.Socket({writable:!1});return this.sockets[e].push(r),

9\r

10`);if(h===-1){ru("have not received end of HTTP headers yet..."),s();return}let g=_.slice(0,h).toString("ascii").split(`\r

11`),y=g.shift();if(!y)return t.destroy(),r(new Error("No header received from proxy CONNECT response"));let T=y.split(" "),P=+T[1],x=T.slice(2).join(" "),N={};for(let L of g){if(!L)continue;let X=L.indexOf(":");if(X===-1)return t.destroy(),r(new Error(`Invalid header from proxy CONNECT response: "${L}"`));let W=L.slice(0,X).toLowerCase(),G=L.slice(X+1).trimStart(),Z=N[W];typeof Z=="string"?N[W]=[Z,G]:Array.isArray(Z)?Z.push(G):N[W]=G}ru("got proxy server response: %o %o",y,N),c(),e({connect:{statusCode:P,statusText:x,headers:N},buffered:_})}o(p,"ondata"),t.on("error",l),t.on("end",d),s()})}o(T0 ...

12`;if(n.username||n.password){let h=`${decodeURIComponent(n.username)}:${decodeURIComponent(n.password)}`;s["Proxy-Authorization"]=`Basic ${Buffer.from(h).toString(

13`;let l=(0,C0.parseProxyResponse)(i);i.write(`${d}\r

14`);let{connect:p,buffered:f}=await l;if(e.emit("proxyConnect",p),this.emit("proxyConnect",p,e),p.statusCode===200)return e.once("socket",$0),r.secureEndpoint?(ra("Upgrading socket connection to TLS"),Rb.connect({...Cb(Ob(r),"host","path"

15Content-Disposition: form-data; name="`;return t.forEach((s,c)=>typeof s=="string"?n.push(i+xd(c)+`"\r

16\r

17${s.replace(/\r(?!\n)|(?<!\r)\n/g,`\r

18`)}\r

19`):n.push(i+xd(c)+`"; filename="${xd(s.name,1)}"\r

20Content-Type: ${s.type||"application/octet-stream"}\r

21\r

22`,s,`\r

23`)),n.push(`--${r}--`),new e(n,{type:"multipart/form-data; boundary="+r})}var oa,U0,M0,Bb,j0,qb,xd,no,Dn,au=gt(()=>{na();Td();({toStringTag:oa,iterator:U0,hasInstance:M0}=Symbol),Bb=Math.random,j0="append,set,get,getAll,delete,keys,values,entries,forEach,constructor".split(","),qb=o((t,e,r)=>(t+="",/^(Blob|File)$/.test(e&&e[oa])?[(r=r!==void 0?r+"":e[oa]=="File"?e.name:"blob",t),e.name!==r||e[oa]=="blob"?new zn([e],r,e):e]:[t,e+""]),"f"),xd=o((t,e)=>(e?t:t.replace(/\r?\n|\r/g,`\r

24`)).replace(/\n/g,"%0A").replace(/\r/g,"%0D").replace(/"/g,"%22"),"e"),no=o((t,e,r)=>{if(e.length<r)throw

25--`+e;let r=new Uint8Array(e.length);for(let n=0;n<e.length;n++)r[n]=e.charCodeAt(n),this.boundaryChars[r[n]]=!0;this.boundary=r,this.lookbehind=new Uint8Array(this.boundary.length+8),this.state=Ke.START_BOUNDARY}write(e){let r=0,n=e.length,i=this.index,{lookbehind:s,boundary:c,boundaryChars:d,index:l,state:p,flags:f}=this,_=this.boundary.length,h=_-1,g=e.length,y,T,P=o(X=>{this[X+"Mark"]=r},"mark"),x=o(X=>{delete this[X+"Mark"]},"clear"),N=o((X,W,G,Z)=>{(W===void 0||W!==G)&&this[X](Z&&Z.subarray(W,G))},"callback"),L=o((X,W)=>{let G=X+"Mark";G in this&&(W?(N(X,this[G],r,e),delete this[G]):(N(X ...

26\r

27`),n=!1,i=!1,s;t.on("response",c=>{let{headers:d}=c;n=d["transfer-encoding"]==="chunked"&&!d["content-length"]}),t.on

28Content-Type: ${s}\r

29\r

30`,typeof i.content=="string"?yield i.content:yield*i.content,yield`\r

31`}yield n}static#i;static#a;static async#s(){return this.#i||=(await Promise.resolve().then(()=>ft(Nb()))).HttpsProxyAgent,this.#i}static async#u(){let e=typeof window<"u"&&!!window;return this.#a||=e?window.fetch:(await Promise.resolve().then(()=>(IP(),wP))).default,this.#a}static mergeHeaders(e,...r){e=e instanceof Headers?e:new Headers(e);for(let n of r)(n instanceof Headers?n:new Headers(n)).forEach((s,c)=>{c==="set-cookie"?e.append(c,s):e.set(c,s)});return e}};Xo.Gaxios=yu;Yo=yu});var st=k(wt=>{"use strict";var a$=wt&&wt.__createBinding||(Object.create?(function(t,e,r,n){n===void 0&&(n=r) ...

32`+n+P.join(`,

33`+n)+`

34`+T+"]":"["+P.join(",")+"]",n=T,g}if(c&&typeof c=="object")for(y=c.length,_=0;_

35`+n+P.join(`,

36`+n)+`

37`+T+"}":"{"+P.join(",")+"}",n=T,g}}o(l,"str"),typeof zP.stringify!="function"&&(zP.stringify=function(p,f

38`,r:"\r",t:" "},s,c=o(function(T){throw{name:"SyntaxError",message:T,at:r,text:s}},"error"),d=o(function(T){return T&&T!==n&&c("Expected '"+T+"' instead of '"+n+"'"),n=s.charAt(r),r+=1,n},"next"),l=o(function(){var T,P="";for(n==="-"&&(P="-",d("-"));n>="0"&&n<="9";)P+=n,d();if(n===".")for(P+=".";d()&&n>="0"&&n<="9";)P+=n;if(n==="e"||n==="E")for(P+=n,d(),(n==="-"||n==="+")&&(P+=n,d());n>="0"&&n<="9";)P+=n,d();if(T=+P,!isFinite(T))c("Bad number");else return vu==null&&(vu=Ud()),P.length>15?e.storeAsString?P:e.useNativeBigInt?BigInt(P):new vu(P):e.alwaysParseAsBig?e.useNativeBigInt?BigInt(T):new ...

39 Supported algorithms are:

40 "HS256", "HS384", "HS512", "RS256", "RS384", "RS512", "PS256", "PS384", "PS512", "ES256", "ES384", "ES512" and "none".`,ba="secret must be a string or buffer",ii="key must be a string or a buffer",Bk="key must be a string, a buffer or an object",bp=typeof ir.createPublicKey=="function";bp&&(ii+=" or a KeyObject",ba+="or a KeyObject");function zS(t){if(!

41`});let f=p.join(";"),_=await t.crypto.sha256DigestHex(r),h=`${t.method.toUpperCase()}

High

Cloud Metadata Access

Source reaches cloud instance metadata or link-local credential endpoints.

src/index.jsView on unpkg · L1

42${t.canonicalUri}

43${t.canonicalQuerystring}

44${l}

45${f}

46${_}`,g=`${c}/${t.region}/${n}/${uz}`,y=`${CE}

47${s}

48${g}

49`+await t.crypto.sha256DigestHex(h),T=await cz(t.crypto,t.securityCredentials.secretAccessKey,c,t.region,n),P=await wa(t.crypto,T,y),x=`${CE} Credential=${t.securityCredentials.accessKeyId}/${g}, SignedHeaders=${f}, Signature=${(0,$E.fromArrayBufferToHex)(P)}`;return{amzDate:e.has("date")?void 0:s,authorizationHeader:x,canonicalQuerystring:t.canonicalQuerystring}}o(lz,"generateAuthenticationHeaderMap")});var kE=k(ec=>{"use strict";Object.defineProperty(ec,"__esModule",{value:!0});ec.DefaultAwsSecurityCredentialsSupplier=void 0;var Qu=Ht(),rf=class{static{o(this,"DefaultAwsSecurityCredentialsSu ...

50To learn more about authentication and Google APIs, visit:

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

src/index.jsView on unpkg · L37

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

src/index.jsView on unpkg · L37

High

Trigger Reachable Command Output Exfiltration

A manifest entrypoint or package-local install chain reaches command-output exfiltration behavior.

src/index.jsView on unpkg · L37

High

Child Process

Package source references child process execution.

src/index.jsView on unpkg · L48

51https://cloud.google.com/docs/authentication/getting-started`,NO_CREDENTIALS_FOUND:`Unable to find credentials in current environment.

52To learn more about authentication and Google APIs, visit:

53https://cloud.google.com/docs/authentication/getting-started`,NO_ADC_FOUND:"Could not load the default credentials. Browse to https://cloud.google.com/docs/authentication/getting-started for more information.",NO_UNIVERSE_DOMAIN_FOUND:`Unable to detect a Universe Domain in the current environment.

54To learn more about Universe Domain retrieval, visit:

55https://cloud.google.com/compute/docs/metadata/predefined-metadata-keys`};var Ef=class{static{o(this,"GoogleAuth")}checkIsGCE=void 0;useJWTAccessWithScope;defaultServicePath;get isGCE(){return this.checkIsGCE}_findProjectIdPromise;_cachedProjectId;jsonContent=null;apiKey;cachedCredential=null;#e=null;defaultScopes;keyFilename;scopes;clientOptions={};constructor(e={}){if(this._cachedProjectId=e.projectId||null,this.cachedCredential=e.authClient||null,this.keyFilename=e.keyFilename||e.keyFile,this.scopes=e.scopes,this.clientOptions=e.clientOptions||{},this.jsonContent=e.credentials||null,this.ap ...

56`)>=0)return!1;return!0}o(kD,"singleLineValues");function ND(t,e){var r;if(t.indent===" ")r=" ";else if(typeof t.indent=="number"&&t.indent>0)r=jr.call(Array(t.indent+1)," ");else return null;return{base:r,prev:jr.call(Array(e+1),r)}}o(ND,"getIndent");function Mf(t,e){if(t.length===0)return"";var r=`

57`+e.prev+e.base;return r+jr.call(t,","+r)+`

58`+e.prev}o(Mf,"indentedJoin");function pc(t,e){var r=Uf(t),n=[];if(r){n.length=t.length;for(var i=0;i<t.length;i++)n[i]=cn(t,i)?e(t[i],t):""}var s=typeof $f=="function"?$f(t):[],c;if(yi){c={};for(var d=0;d<s.length;d++)c["$"+s[d]]=s[d]}for(var l in t)cn(t,l)&&(r&&String(Number(l))===l&&l<t.length||yi&&c["$"+l]instanceof Symbol||(mT.call(/[^\w$]/,l)?n.push(e(l,t)+": "+e(t[l],t)):n.push(l+": "+e(t[l],t))));if(typeof $f=="function")for(var p=0;p<s.length;p++)hT.call(t,s[p])&&n.push("["+e(s[p])+"]: "+e(t[s[p]],t));return n}o(pc,"arrObjKeys")});var ET=k((OX,ST)=>{"use strict";var zD=Ua(),DD=Cn(),hc ...

59'${x}`}_(new Error(P,{cause:c}))}f(c)})}).on("error",h=>{_(h)})}catch(h){tm(r).then(()=>_(h)).

60`),this.push(T),L()}}),x=new im,N=a1(g[1].body);d["content-type"]=`multipart/related; boundary=${y}`;for(let L of g){let X=`--${y}\r

61content-type: ${L["content-type"]}\r

62\r

63`;P.push(X),typeof L.body=="string"?(P.push(L.body),P.push(`\r

64`)):(x.on("progress",W=>{e.onUploadProgress&&e.onUploadProgress({bytesRead:W})}),L.body.pipe(x).pipe(P))}N||(P.push(T),P.push(null)),e.data=P}o(p,"multipartUpload");function f(g){let y=ex(),T=`--${y}--`;d["content-type"]=`multipart/related; boundary=${y}`;let P="";for(let x of g){let N=`--${y}\r

65content-type: ${x["content-type"]}\r

66\r

67`;P+=N,typeof x.body=="string"&&(P+=x.body,P+=`\r

68`)}P+=T,e.data=P}if(o(f,"browserMultipartUpload"),t.mediaUrl&&n.body)if(e.url=t.mediaUrl,i){r.uploadType="multipart";let g=[{"content-type":"application/json",body:JSON.stringify(i)},{"content-type":n.mimeType||i&&i.mimeType||c,body:n.body}];(0,om.isBrowser)()?f(g):p(g)}else r.uploadType="media",Object.assign(d,{"content-type":n.mimeType||c}),e.data=n.body;else e.data=i||void 0;if(e.headers=rm.Gaxios.mergeHeaders(e.headers||{},d),e.params=r,!(0,om.isBrowser)()){e.headers.set("Accept-Encoding","gzip"),e.userAgentDirectives.push({product:"google-api-nodejs-client",version:nx.version,comment:"gzi ...

Long lines were clipped for display.

Source & flagged code

5 flagged · loading source

src/index.jsView file

48${g} L49: `+await t.crypto.sha256DigestHex(h),T=await cz(t.crypto,t.securityCredentials.secretAccessKey,c,t.region,n),P=await wa(t.crypto,T,y),x=`${CE} Credential=${t.securityCredentials.acc... L50: To learn more about authentication and Google APIs, visit:

High

Child Process

Package source references child process execution.

src/index.jsView on unpkg · L48

37`+T+"}":"{"+P.join(",")+"}",n=T,g}}o(l,"str"),typeof zP.stringify!="function"&&(zP.stringify=function(p,f,_){var h;if(n="",i="",typeof _=="number")for(h=0;h<_;h+=1)i+=" ";else type... L38: `,r:"\r",t:" "},s,c=o(function(T){throw{name:"SyntaxError",message:T,at:r,text:s}},"error"),d=o(function(T){return T&&T!==n&&c("Expected '"+T+"' instead of '"+n+"'"),n=s.charAt(r),... L39: Supported algorithms are: ... L48: ${g} L49: `+await t.crypto.sha256DigestHex(h),T=await cz(t.crypto,t.securityCredentials.secretAccessKey,c,t.region,n),P=await wa(t.crypto,T,y),x=`${CE} Credential=${t.securityCredentials.acc... L50: To learn more about authentication and Google APIs, visit:

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

src/index.jsView on unpkg · L37

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

src/index.jsView on unpkg · L37

1"use strict";var tw=Object.create;var Ii=Object.defineProperty;var rw=Object.getOwnPropertyDescriptor;var nw=Object.getOwnPropertyNames;var ow=Object.getPrototypeOf,iw=Object.proto... L2: `;Ue.DEFAULT_CONTENT_TYPE="application/octet-stream";Ue.prototype.append=function(t,e,r){r=r||{},typeof r=="string"&&(r={filename:r});var n=cd.prototype.append.bind(this);if((typeo... L3: `)||n,code:s,status:i},e.data.error)}return Object.assign({message:n,code:s,status:i},e.data.error)}}return{message:n,code:e.status,status:e.statusText}}};er.GaxiosError=dd;functio... L4: `).join(` ... L37: `+T+"}":"{"+P.join(",")+"}",n=T,g}}o(l,"str"),typeof zP.stringify!="function"&&(zP.stringify=function(p,f,_){var h;if(n="",i="",typeof _=="number")for(h=0;h<_;h+=1)i+=" ";else type... L38: `,r:"\r",t:" "},s,c=o(fu

High

Cloud Metadata Access

Source reaches cloud instance metadata or link-local credential endpoints.

src/index.jsView on unpkg · L1

37Trigger-reachable command-output exfiltration chain: manifest.main -> src/index.js L37: `+T+"}":"{"+P.join(",")+"}",n=T,g}}o(l,"str"),typeof zP.stringify!="function"&&(zP.stringify=function(p,f,_){var h;if(n="",i="",typeof _=="number")for(h=0;h<_;h+=1)i+=" ";else type... L38: `,r:"\r",t:" "},s,c=o(function(T){throw{name:"SyntaxError",message:T,at:r,text:s}},"error"),d=o(function(T){return T&&T!==n&&c("Expected '"+T+"' instead of '"+n+"'"),n=s.charAt(r),... L39: Supported algorithms are: ... L48: ${g} L49: `+await t.crypto.sha256DigestHex(h),T=await cz(t.crypto,t.securityCredentials.secretAccessKey,c,t.region,n),P=await wa(t.crypto,T,y),x=`${CE} Credential=${t.securityCredentials.acc... L50: To learn more about authentication and Google APIs, visit:

High

Trigger Reachable Command Output Exfiltration

A manifest entrypoint or package-local install chain reaches command-output exfiltration behavior.

src/index.jsView on unpkg · L37

@activepieces/piece-google-contacts@0.4.8

OSV Malicious Advisory

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code