registry / @activepieces/piece-google-forms / 0.7.2
@activepieces/piece-google-forms@0.7.2
AI Security Review
scanned 22d ago · by lpm-firewall-aiSource inspection confirms a reachable runtime behavior that weakens TLS verification on authenticated requests, but does not establish credential exfiltration or malicious intent. This warrants a warning for dangerous capability rather than a block.
Static reason
One or more suspicious static signals were detected.
Trigger
A Google Forms action or polling trigger sends an HTTP request.
Impact
A network attacker able to intercept traffic may impersonate the service or capture the bearer token. No transfer to an unrelated recipient was identified.
Mechanism
The request method changes the process-wide TLS verification environment setting before calling fetch; the client sends a bearer token to the Google Forms API.
AI rationale
Source inspection confirms a reachable runtime behavior that weakens TLS verification on authenticated requests, but does not establish credential exfiltration or malicious intent. This warrants a warning for dangerous capability rather than a block.
Evidence
src/index.js
Network endpoints1
forms.googleapis.com/v1
Decision evidence
public snapshotAI called this Suspicious at 88.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The manifest points to src/index.js and declares no install lifecycle scripts.
- The active HTTP client sets NODE_TLS_REJECT_UNAUTHORIZED to 0 before sending requests, disabling TLS certificate verification.
- The package constructs that client and configures authenticated requests to the Google Forms API.
Evidence against
- The configured API destination is Google Forms, consistent with the package’s stated function; no unrelated credential recipient was identified.
- The risky behavior is in the runtime request path; the manifest shows no install-time trigger.
Behavioral surface
ChildProcessCryptoEnvironmentVarsEvalFilesystemNetworkShell
HighEntropyStringsMinifiedPossibleObfuscationUrlStrings
NoLicense
Source & flagged code
5 flaggedsrc/index.jsView file
48${h}
L49: `+await e.crypto.sha256DigestHex(_),S=await T6(e.crypto,e.securityCredentials.secretAccessKey,s,e.region,o),T=await yu(e.crypto,S,b),x=`${Hk} Credential=${e.securityCredentials.acc...
L50: To learn more about authentication and Google APIs, visit:
High
37`+S+"}":"{"+T.join(",")+"}",o=S,h}}a(d,"str"),typeof KO.stringify!="function"&&(KO.stringify=function(p,m,g){var _;if(o="",r="",typeof g=="number")for(_=0;_<g;_+=1)r+=" ";else type...
L38: `,r:"\r",t:" "},i,s=a(function(S){throw{name:"SyntaxError",message:S,at:n,text:i}},"error"),u=a(function(S){return S&&S!==o&&s("Expected '"+S+"' instead of '"+o+"'"),o=i.charAt(n),...
L39: Supported algorithms are:
...
L48: ${h}
L49: `+await e.crypto.sha256DigestHex(_),S=await T6(e.crypto,e.securityCredentials.secretAccessKey,s,e.region,o),T=await yu(e.crypto,S,b),x=`${Hk} Credential=${e.securityCredentials.acc...
L50: To learn more about authentication and Google APIs, visit:
High
Same File Env Network Execution
A single source file combines environment access, network access, and code or shell execution; review context before blocking.
src/index.jsView on unpkg · L3737
Findings
6 High3 Medium5 Low
HighChild Processsrc/index.js
HighShell
HighSame File Env Network Executionsrc/index.js
HighCommand Output Exfiltrationsrc/index.js
HighCloud Metadata Accesssrc/index.js
HighTrigger Reachable Command Output Exfiltrationsrc/index.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowEval
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
LowNo License
Affected versions and remediation
This report applies to @activepieces/piece-google-forms@0.7.2.
See all versions of @activepieces/piece-google-forms for other recorded verdicts.
- Review the evidence and your use of @activepieces/piece-google-forms@0.7.2 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.