@activepieces/piece-google-forms@0.5.7: Clean npm security report

Loading npm security reports…

@activepieces/piece-google-forms@0.5.7: Clean npm security report | LPM Firewall

Source & flagged code

5 flagged

Lines 1-68javascript

1"use strict";var fT=Object.create;var ai=Object.defineProperty;var mT=Object.getOwnPropertyDescriptor;var hT=Object.getOwnPropertyNames;var gT=Object.getPrototypeOf,yT=Object.prototype.hasOwnProperty;var o=(t,e)=>ai(t,"name",{value:e,configurable:!0});var lt=(t,e,r)=>()=>{if(r)throw r[0];try{return t&&(e=t(t=0)),e}catch(n){throw r=[n],n}};var j=(t,e)=>()=>{try{return e||t((e={exports:{}}).exports,e),e.exports}catch(r){throw e=0,r}},Na=(t,e)=>{for(var r in e)ai(t,r,{get:e[r],enumerable:!0})},Lf=(t,e,r,n)=>{if(e&&typeof e=="object"||typeof e=="function")for(let i of hT(e))!yT.call(t,i)&&i!==r&&a ...

2`;Ne.DEFAULT_CONTENT_TYPE="application/octet-stream";Ne.prototype.append=function(t,e,r){r=r||{},typeof r=="string"&&(r={filename:r});var n=pl.prototype.append.bind(this);if((typeof e=="number"||e==null)&&(e=String(e)),Array.isArray(e)){this._error(new Error("Arrays are not supported."));return}var i=this._multiPartHeader(t,e,r),u=this._multiPartFooter();n(i),n(e),n(u),this._trackLength(i,e,r)};Ne.prototype._trackLength=function(t,e,r){var n=0;r.knownLength!=null?n+=Number(r.knownLength):Buffer.isBuffer(e)?n=e.length:typeof e=="string"&&(n=Buffer.byteLength(e)),this._valueLength+=n,this._overh ...

3`)||n,code:u,status:i},e.data.error)}return Object.assign({message:n,code:u,status:i},e.data.error)}}return{message:n,code:e.status,status:e.statusText}}};Xt.GaxiosError=yl;function XI(t,e){switch(t){case"stream":return e;case"json":return

4`).join(`

5`+u),t.push(i+"m+"+Es.exports.humanize(this.diff)+"\x1B[0m")}else t[0]=vR()+e+" "+t[0]}o(_R,"formatArgs");function vR(){return mt.inspectOpts.hideDate?"":new Date().toISOString()+" "}o(vR,"getDate");function bR(...t){return process.stderr.write(Ss.formatWithOptions(mt.inspectOpts,...t)+`

6`)}o(bR,"log");function SR(t){t?process.env.DEBUG=t:delete process.env.DEBUG}o(SR,"save");function ER(){return process.env.DEBUG}o(ER,"load");function PR(t){t.inspectOpts={};let e=Object.keys(mt.inspectOpts);for(let r=0;r<e.length;r++)t.inspectOpts[e[r]]=mt.inspectOpts[e[r]]}o(PR,"init");Es.exports=El()(mt);var{formatters:B_}=Es.exports;B_.o=function(t){return this.inspectOpts.colors=this.useColors,Ss.inspect(t,this.inspectOpts).split(`

7`).map(e=>e.trim()).join(" ")};B_.O=function(t){return this.inspectOpts.colors=this.useColors,Ss.inspect(t,this.inspectOpts)}});var Al=j((mW,xl)=>{typeof process>"u"||process.type==="renderer"||process.browser===!0||process.__nwjs?xl.exports=D_():xl.exports=q_()});var G_=j(wt=>{"use strict";var TR=wt&&wt.__createBinding||(Object.create?(function(t,e,r,n){n===void 0&&(n=r);var i=Object.getOwnPropertyDescriptor(e,r);(!i||("get"in i?!e.__esModule:i.writable||i.configurable))&&(i={enumerable:!0,get:o(function(){return e[r]},"get")}),Object.defineProperty(t,n,i)}):(function(t,e,r,n){n===void 0&&(n= ...

8`).some(n=>n.indexOf("(https.js:")!==-1||n.indexOf("node:https:")!==-1)}incrementSockets(e){if(this.maxSockets===1/0&&this.maxTotalSockets===1/0)return null;this.sockets[e]||(this.sockets[e]=[]);let r=new kR.Socket({writable:!1});return this.sockets[e].push(r),

9\r

10`);if(P===-1){Ps("have not received end of HTTP headers yet..."),u();return}let h=S.slice(0,P).toString("ascii").split(`\r

11`),v=h.shift();if(!v)return t.destroy(),r(new Error("No header received from proxy CONNECT response"));let x=v.split(" "),E=+x[1],A=x.slice(2).join(" "),M={};for(let G of h){if(!G)continue;let ee=G.indexOf(":");if(ee===-1)return t.destroy(),r(new Error(`Invalid header from proxy CONNECT response: "${G}"`));let W=G.slice(0,ee).toLowerCase(),H=G.slice(ee+1).trimStart(),Z=M[W];typeof Z=="string"?M[W]=[Z,H]:Array.isArray(Z)?Z.push(H):M[W]=H}Ps("got proxy server response: %o %o",v,M),c(),e({connect:{statusCode:E,statusText:A,headers:M},buffered:S})}o(f,"ondata"),t.on("error",p),t.on("end",l),u()})} ...

12`;if(n.username||n.password){let P=`${decodeURIComponent(n.username)}:${decodeURIComponent(n.password)}`;u["Proxy-Authorization"]=`Basic ${Buffer.from(P).toString

13`;let p=(0,qR.parseProxyResponse)(i);i.write(`${l}\r

14`);let{connect:f,buffered:m}=await p;if(e.emit("proxyConnect",f),this.emit("proxyConnect",f,e),f.statusCode===200)return e.once("socket",VR),r.secureEndpoint?(ki("Upgrading socket connection to TLS"),X_.connect({...ev(Q_(r),"host"

15Content-Disposition: form-data; name="`;return t.forEach((u,c)=>typeof u=="string"?n.push(i+Cl(c)+`"\r

16\r

17${u.replace(/\r(?!\n)|(?<!\r)\n/g,`\r

18`)}\r

19`):n.push(i+Cl(c)+`"; filename="${Cl(u.name,1)}"\r

20Content-Type: ${u.type||"application/octet-stream"}\r

21\r

22`,u,`\r

23`)),n.push(`--${r}--`),new e(n,{type:"multipart/form-data; boundary="+r})}var zi,KR,JR,dv,YR,pv,Cl,Bn,Pn,ws=lt(()=>{$i();Ol();({toStringTag:zi,iterator:KR,hasInstance:JR}=Symbol),dv=Math.random,YR="append,set,get,getAll,delete,keys,values,entries,forEach,constructor".split(","),pv=o((t,e,r)=>(t+="",/^(Blob|File)$/.test(e&&e[zi])?[(r=r!==void 0?r+"":e[zi]=="File"?e.name:"blob",t),e.name!==r||e[zi]=="blob"?new En([e],r,e):e]:[t,e+""]),"f"),Cl=o((t,e)=>(e?t:t.replace(/\r?\n|\r/g,`\r

24`)).replace(/\n/g,"%0A").replace(/\r/g,"%0D").replace(/"/g,"%22"),"e"),Bn=o((t,e,r)=>{if(e.length<r)throw

25--`+e;let r=new Uint8Array(e.length);for(let n=0;n<e.length;n++)r[n]=e.charCodeAt(n),this.boundaryChars[r[n]]=!0;this.boundary=r,this.lookbehind=new Uint8Array(this.boundary.length+8),this.state=Ge.START_BOUNDARY}write(e){let r=0,n=e.length,i=this.index,{lookbehind:u,boundary:c,boundaryChars:l,index:p,state:f,flags:m}=this,S=this.boundary.length,P=S-1,h=e.length,v,x,E=o(ee=>{this[ee+"Mark"]=r},"mark"),A=o(ee=>{delete this[ee+"Mark"]},"clear"),M=o((ee,W,H,Z)=>{(W===void 0||W!==H)&&this[ee](Z&&Z.subarray(W,H))},"callback"),G=o((ee,W)=>{let H=ee+"Mark";H in this&&(W?(M(ee,this[H],r,e),delete this ...

26\r

27`),n=!1,i=!1,u;t.on("response",c=>{let{headers:l}=c;n=l["transfer-encoding"]==="chunked"&&!l["content-length"]}),t.on

28Content-Type: ${u}\r

29\r

30`,typeof i.content=="string"?yield i.content:yield*i.content,yield`\r

31`}yield n}static#i;static#a;static async#s(){return this.#i||=(await Promise.resolve().then(()=>dt(nv()))).HttpsProxyAgent,this.#i}static async#u(){let e=typeof window<"u"&&!!window;return this.#a||=e?window.fetch:(await Promise.resolve().then(()=>(Yv(),Jv))).default,this.#a}static mergeHeaders(e,...r){e=e instanceof Headers?e:new Headers(e);for(let n of r)(n instanceof Headers?n:new Headers(n)).forEach((u,c)=>{c==="set-cookie"?e.append(c,u):e.set(c,u)});return e}};$o.Gaxios=Ms;ko=Ms});var gt=j(Pt=>{"use strict";var _O=Pt&&Pt.__createBinding||(Object.create?(function(t,e,r,n){n===void 0&&(n=r) ...

32`+n+E.join(`,

33`+n)+`

34`+x+"]":"["+E.join(",")+"]",n=x,h}if(c&&typeof c=="object")for(v=c.length,S=0;

35`+n+E.join(`,

36`+n)+`

37`+x+"}":"{"+E.join(",")+"}",n=x,h}}o(p,"str"),typeof ob.stringify!="function"&&(ob.stringify=function(f,m,

38`,r:"\r",t:" "},u,c=o(function(x){throw{name:"SyntaxError",message:x,at:r,text:u}},"error"),l=o(function(x){return x&&x!==n&&c("Expected '"+x+"' instead of '"+n+"'"),n=u.charAt(r),r+=1,n},"next"),p=o(function(){var x,E="";for(n==="-"&&(E="-",l("-"));n>="0"&&n<="9";)E+=n,l();if(n===".")for(E+=".";l()&&n>="0"&&n<="9";)E+=n;if(n==="e"||n==="E")for(E+=n,l(),(n==="-"||n==="+")&&(E+=n,l());n>="0"&&n<="9";)E+=n,l();if(x=+E,!isFinite(x))c("Bad number");else return Ls==null&&(Ls=ql()),E.length>15?e.storeAsString?E:e.useNativeBigInt?BigInt(E):new Ls(E):e.alwaysParseAsBig?e.useNativeBigInt?BigInt(x):new ...

39 Supported algorithms are:

40 "HS256", "HS384", "HS512", "RS256", "RS384", "RS512", "PS256", "PS384", "PS512", "ES256", "ES384", "ES512" and "none".`,Ji="secret must be a string or buffer",Lo="key must be a string or a buffer",ek="key must be a string, a buffer or an object",Ad=typeof nr.createPublicKey=="function";Ad&&(Lo+=" or a KeyObject",Ji+="or a KeyObject");function oS(t){if(!

41`});let m=f.join(";"),S=await t.crypto.sha256DigestHex(r),P=`${t.method.toUpperCase()}

High

Cloud Metadata Access

Source reaches cloud instance metadata or link-local credential endpoints.

src/index.jsView on unpkg · L1

42${t.canonicalUri}

43${t.canonicalQuerystring}

44${p}

45${m}

46${S}`,h=`${c}/${t.region}/${n}/${b$}`,v=`${eE}

47${u}

48${h}

49`+await t.crypto.sha256DigestHex(P),x=await S$(t.crypto,t.securityCredentials.secretAccessKey,c,t.region,n),E=await na(t.crypto,x,v),A=`${eE} Credential=${t.securityCredentials.accessKeyId}/${h}, SignedHeaders=${m}, Signature=${(0,tE.fromArrayBufferToHex)(E)}`;return{amzDate:e.has("date")?void 0:u,authorizationHeader:A,canonicalQuerystring:t.canonicalQuerystring}}o(E$,"generateAuthenticationHeaderMap")});var rE=j(Su=>{"use strict";Object.defineProperty(Su,"__esModule",{value:!0});Su.DefaultAwsSecurityCredentialsSupplier=void 0;var bu=qt(),up=class{static{o(this,"DefaultAwsSecurityCredentialsSu ...

50To learn more about authentication and Google APIs, visit:

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

src/index.jsView on unpkg · L37

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

src/index.jsView on unpkg · L37

High

Trigger Reachable Command Output Exfiltration

A manifest entrypoint or package-local install chain reaches command-output exfiltration behavior.

src/index.jsView on unpkg · L37

High

Child Process

Package source references child process execution.

src/index.jsView on unpkg · L48

51https://cloud.google.com/docs/authentication/getting-started`,NO_CREDENTIALS_FOUND:`Unable to find credentials in current environment.

52To learn more about authentication and Google APIs, visit:

53https://cloud.google.com/docs/authentication/getting-started`,NO_ADC_FOUND:"Could not load the default credentials. Browse to https://cloud.google.com/docs/authentication/getting-started for more information.",NO_UNIVERSE_DOMAIN_FOUND:`Unable to detect a Universe Domain in the current environment.

54To learn more about Universe Domain retrieval, visit:

55https://cloud.google.com/compute/docs/metadata/predefined-metadata-keys`};var Ip=class{static{o(this,"GoogleAuth")}checkIsGCE=void 0;useJWTAccessWithScope;defaultServicePath;get isGCE(){return this.checkIsGCE}_findProjectIdPromise;_cachedProjectId;jsonContent=null;apiKey;cachedCredential=null;#e=null;defaultScopes;keyFilename;scopes;clientOptions={};constructor(e={}){if(this._cachedProjectId=e.projectId||null,this.cachedCredential=e.authClient||null,this.keyFilename=e.keyFilename||e.keyFile,this.scopes=e.scopes,this.clientOptions=e.clientOptions||{},this.jsonContent=e.credentials||null,this.ap ...

56i.e ${HI(e,f)}/resource or /resource`,required:!0,defaultValue:f?e(f):"",...c?.url??{}})}),"props")}),method:ke.StaticDropdown({displayName:"Method",required:!0,options:{options:Object.values(vn).map(f=>({label:f,value:f}))},...c?.method??{}}),headers:ke.Object({displayName:"Headers",description:"Authorization headers are injected automatically from your connection.",required:!0,...c?.headers??{}}),queryParams:ke.Object({displayName:"Query Parameters",required:!0,...c?.queryParams??{}}),body_type:ke.StaticDropdown({displayName:"Body Type",required:!1,defaultValue:"none",options:{disabled:!1,op ...

57/*! Bundled license information:

59mime-types/index.js:

60 (*!

61 * mime-types

64 * MIT Licensed

65 *)

67web-streams-polyfill/dist/ponyfill.es2018.js:

68 (**

Long lines were clipped for display.

Source & flagged code

5 flagged · loading source

src/index.jsView file

48${h} L49: `+await t.crypto.sha256DigestHex(P),x=await S$(t.crypto,t.securityCredentials.secretAccessKey,c,t.region,n),E=await na(t.crypto,x,v),A=`${eE} Credential=${t.securityCredentials.acc... L50: To learn more about authentication and Google APIs, visit:

High

Child Process

Package source references child process execution.

src/index.jsView on unpkg · L48

37`+x+"}":"{"+E.join(",")+"}",n=x,h}}o(p,"str"),typeof ob.stringify!="function"&&(ob.stringify=function(f,m,S){var P;if(n="",i="",typeof S=="number")for(P=0;P<S;P+=1)i+=" ";else type... L38: `,r:"\r",t:" "},u,c=o(function(x){throw{name:"SyntaxError",message:x,at:r,text:u}},"error"),l=o(function(x){return x&&x!==n&&c("Expected '"+x+"' instead of '"+n+"'"),n=u.charAt(r),... L39: Supported algorithms are: ... L48: ${h} L49: `+await t.crypto.sha256DigestHex(P),x=await S$(t.crypto,t.securityCredentials.secretAccessKey,c,t.region,n),E=await na(t.crypto,x,v),A=`${eE} Credential=${t.securityCredentials.acc... L50: To learn more about authentication and Google APIs, visit:

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

src/index.jsView on unpkg · L37

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

src/index.jsView on unpkg · L37

1"use strict";var fT=Object.create;var ai=Object.defineProperty;var mT=Object.getOwnPropertyDescriptor;var hT=Object.getOwnPropertyNames;var gT=Object.getPrototypeOf,yT=Object.proto... L2: `;Ne.DEFAULT_CONTENT_TYPE="application/octet-stream";Ne.prototype.append=function(t,e,r){r=r||{},typeof r=="string"&&(r={filename:r});var n=pl.prototype.append.bind(this);if((typeo... L3: `)||n,code:u,status:i},e.data.error)}return Object.assign({message:n,code:u,status:i},e.data.error)}}return{message:n,code:e.status,status:e.statusText}}};Xt.GaxiosError=yl;functio... L4: `).join(` ... L37: `+x+"}":"{"+E.join(",")+"}",n=x,h}}o(p,"str"),typeof ob.stringify!="function"&&(ob.stringify=function(f,m,S){var P;if(n="",i="",typeof S=="number")for(P=0;P<S;P+=1)i+=" ";else type... L38: `,r:"\r",t:" "},u,c=o(fu

High

Cloud Metadata Access

Source reaches cloud instance metadata or link-local credential endpoints.

src/index.jsView on unpkg · L1

37Trigger-reachable command-output exfiltration chain: manifest.main -> src/index.js L37: `+x+"}":"{"+E.join(",")+"}",n=x,h}}o(p,"str"),typeof ob.stringify!="function"&&(ob.stringify=function(f,m,S){var P;if(n="",i="",typeof S=="number")for(P=0;P<S;P+=1)i+=" ";else type... L38: `,r:"\r",t:" "},u,c=o(function(x){throw{name:"SyntaxError",message:x,at:r,text:u}},"error"),l=o(function(x){return x&&x!==n&&c("Expected '"+x+"' instead of '"+n+"'"),n=u.charAt(r),... L39: Supported algorithms are: ... L48: ${h} L49: `+await t.crypto.sha256DigestHex(P),x=await S$(t.crypto,t.securityCredentials.secretAccessKey,c,t.region,n),E=await na(t.crypto,x,v),A=`${eE} Credential=${t.securityCredentials.acc... L50: To learn more about authentication and Google APIs, visit:

High

Trigger Reachable Command Output Exfiltration

A manifest entrypoint or package-local install chain reaches command-output exfiltration behavior.

src/index.jsView on unpkg · L37

@activepieces/piece-google-forms@0.5.7

AI Security Review

OSV Corroboration

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code