registry / @activepieces/piece-google-contacts / 0.6.0
@activepieces/piece-google-contacts@0.6.0
AI Security Review
scanned 10d ago · by lpm-firewall-aiThe source confirms a process-wide TLS validation weakness in the bundled HTTP client. No concrete malicious activity was established, so this warrants a warning rather than a publication block.
Static reason
One or more suspicious static signals were detected.
Trigger
A request through the bundled FetchHttpClient.
Impact
TLS certificate checks may be disabled for the process, weakening protection against intercepted connections.
Mechanism
The sendRequest method sets NODE_TLS_REJECT_UNAUTHORIZED to 0 before making the request.
AI rationale
The source confirms a process-wide TLS validation weakness in the bundled HTTP client. No concrete malicious activity was established, so this warrants a warning rather than a publication block.
Evidence
src/index.js
Decision evidence
public snapshotAI called this Suspicious at 94.0% confidence as Critical Vulnerability with medium false-positive risk.
Evidence for warning
- The manifest identifies src/index.js as the package entrypoint and lists no lifecycle scripts.
- The bundled HTTP client sets NODE_TLS_REJECT_UNAUTHORIZED to 0 whenever sendRequest runs, disabling Node.js TLS certificate validation process-wide.
Evidence against
Behavioral surface
ChildProcessCryptoEnvironmentVarsEvalFilesystemNetworkShell
HighEntropyStringsMinifiedPossibleObfuscationUrlStrings
NoLicense
Source & flagged code
5 flaggedsrc/index.jsView file
48${h}
L49: `+await t.crypto.sha256DigestHex(m),S=await J2(t.crypto,t.securityCredentials.secretAccessKey,s,t.region,o),E=await Wu(t.crypto,S,_),T=`${GN} Credential=${t.securityCredentials.acc...
L50: To learn more about authentication and Google APIs, visit:
High
37`+S+"}":"{"+E.join(",")+"}",o=S,h}}a(l,"str"),typeof Wk.stringify!="function"&&(Wk.stringify=function(p,f,y){var m;if(o="",n="",typeof y=="number")for(m=0;m<y;m+=1)n+=" ";else type...
L38: `,r:"\r",t:" "},i,s=a(function(S){throw{name:"SyntaxError",message:S,at:r,text:i}},"error"),u=a(function(S){return S&&S!==o&&s("Expected '"+S+"' instead of '"+o+"'"),o=i.charAt(r),...
L39: Supported algorithms are:
...
L48: ${h}
L49: `+await t.crypto.sha256DigestHex(m),S=await J2(t.crypto,t.securityCredentials.secretAccessKey,s,t.region,o),E=await Wu(t.crypto,S,_),T=`${GN} Credential=${t.securityCredentials.acc...
L50: To learn more about authentication and Google APIs, visit:
High
Same File Env Network Execution
A single source file combines environment access, network access, and code or shell execution; review context before blocking.
src/index.jsView on unpkg · L3737
Findings
6 High3 Medium5 Low
HighChild Processsrc/index.js
HighShell
HighSame File Env Network Executionsrc/index.js
HighCommand Output Exfiltrationsrc/index.js
HighCloud Metadata Accesssrc/index.js
HighTrigger Reachable Command Output Exfiltrationsrc/index.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowEval
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
LowNo License
Affected versions and remediation
This report applies to @activepieces/piece-google-contacts@0.6.0.
See all versions of @activepieces/piece-google-contacts for other recorded verdicts.
- Review the evidence and your use of @activepieces/piece-google-contacts@0.6.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.