registry / @activepieces/piece-google-forms / 0.7.1
@activepieces/piece-google-forms@0.7.1
AI Security Review
scanned 20d ago · by lpm-firewall-aiThe source confirms a TLS verification weakness on the client used for authenticated Google API requests. This supports a warning for conditional credential exposure, but not a finding of active theft or malicious intent.
Static reason
One or more suspicious static signals were detected.
Trigger
A piece action or trigger makes an API request through the bundled HTTP client.
Impact
A network attacker able to intercept the connection could expose or alter API traffic, including the bearer token.
Mechanism
The client sets `NODE_TLS_REJECT_UNAUTHORIZED` to `0` and sends requests using `fetch`; Forms requests include a bearer token.
AI rationale
The source confirms a TLS verification weakness on the client used for authenticated Google API requests. This supports a warning for conditional credential exposure, but not a finding of active theft or malicious intent.
Evidence
src/index.js
Network endpoints2
forms.googleapis.comwww.googleapis.com
Decision evidence
public snapshotAI called this Suspicious at 94.0% confidence as Critical Vulnerability with medium false-positive risk.
Evidence for warning
- The manifest points to `src/index.js` and defines no lifecycle scripts.
- The bundled HTTP client sets `NODE_TLS_REJECT_UNAUTHORIZED` to `0` before sending a request, then uses `fetch`.
- The client used by the piece is instantiated as `xr` and sends Google Forms requests with a bearer token.
- The Forms action obtains its token and sends it to `forms.googleapis.com`. Disabling TLS verification makes interception of that credential possible in a network attack.
Evidence against
- The inspected Forms requests target Google APIs and use the supplied Google account token; no unrelated recipient or active credential theft was identified.
Behavioral surface
ChildProcessCryptoEnvironmentVarsEvalFilesystemNetworkShell
HighEntropyStringsMinifiedPossibleObfuscationUrlStrings
Source & flagged code
5 flaggedsrc/index.jsView file
48${h}
L49: `+await e.crypto.sha256DigestHex(_),S=await x6(e.crypto,e.securityCredentials.secretAccessKey,s,e.region,o),x=await yu(e.crypto,S,b),T=`${Hk} Credential=${e.securityCredentials.acc...
L50: To learn more about authentication and Google APIs, visit:
High
37`+S+"}":"{"+x.join(",")+"}",o=S,h}}a(d,"str"),typeof KO.stringify!="function"&&(KO.stringify=function(p,m,g){var _;if(o="",r="",typeof g=="number")for(_=0;_<g;_+=1)r+=" ";else type...
L38: `,r:"\r",t:" "},i,s=a(function(S){throw{name:"SyntaxError",message:S,at:n,text:i}},"error"),u=a(function(S){return S&&S!==o&&s("Expected '"+S+"' instead of '"+o+"'"),o=i.charAt(n),...
L39: Supported algorithms are:
...
L48: ${h}
L49: `+await e.crypto.sha256DigestHex(_),S=await x6(e.crypto,e.securityCredentials.secretAccessKey,s,e.region,o),x=await yu(e.crypto,S,b),T=`${Hk} Credential=${e.securityCredentials.acc...
L50: To learn more about authentication and Google APIs, visit:
High
Same File Env Network Execution
A single source file combines environment access, network access, and code or shell execution; review context before blocking.
src/index.jsView on unpkg · L3737
Findings
6 High3 Medium5 Low
HighChild Processsrc/index.js
HighShell
HighSame File Env Network Executionsrc/index.js
HighCommand Output Exfiltrationsrc/index.js
HighCloud Metadata Accesssrc/index.js
HighTrigger Reachable Command Output Exfiltrationsrc/index.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowEval
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
LowNo License
Affected versions and remediation
This report applies to @activepieces/piece-google-forms@0.7.1.
See all versions of @activepieces/piece-google-forms for other recorded verdicts.
- Review the evidence and your use of @activepieces/piece-google-forms@0.7.1 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.