{
  "affected": [
    {
      "database_specific": {
        "cwes": [
          {
            "cweId": "CWE-506",
            "description": "The product contains code that appears to be malicious in nature.",
            "name": "Embedded Malicious Code"
          },
          {
            "cweId": "CWE-506",
            "description": "The product contains code that appears to be malicious in nature.",
            "name": "Embedded Malicious Code"
          }
        ],
        "indicators": {
          "evidence_files": [
            {
              "path": "src/index.js",
              "sha256": "d38c7941d0bc5c6a60c781bbe47e528878fc871542c233ccddb387320393f0dc",
              "tlsh": "eea45c86b3a1b47243e760e0e43f4507f3759858845c4074f798cdeb28a988aa6bff75"
            }
          ],
          "package_integrity": [
            {
              "filename": "piece-google-bigquery-0.0.6.tgz",
              "hashes": {
                "sha1": "724d3dba52921c9db645b8ba478c2aa11d0381fd",
                "sha512_sri": "sha512-wWxsYzW04l4t45E1kRCXwmXBPazz9SJ7I7fsGw363RgeoI8QT4Qt6XppB7eBbrRVsJ+0g4zDn1uczCgnwxvyKQ=="
              }
            }
          ]
        }
      },
      "package": {
        "ecosystem": "npm",
        "name": "@activepieces/piece-google-bigquery"
      },
      "versions": [
        "0.0.6",
        "0.0.5"
      ]
    }
  ],
  "credits": [
    {
      "contact": [
        "inspector-research@amazon.com"
      ],
      "name": "Amazon Inspector",
      "type": "FINDER"
    }
  ],
  "database_specific": {
    "malicious-packages-origins": [
      {
        "id": "IN-MAL-2026-016277",
        "import_time": "2026-08-06T13:09:09.603851971Z",
        "modified_time": "2026-08-06T12:57:30Z",
        "sha256": "697ef2a7cda3bcaad9ed5938e7b59f66c74a49bbeede863d21b530988bca2f13",
        "source": "amazon-inspector",
        "versions": [
          "0.0.6"
        ]
      },
      {
        "id": "IN-MAL-2026-016382",
        "import_time": "2026-08-06T14:19:46.243858508Z",
        "modified_time": "2026-08-06T13:17:48Z",
        "sha256": "acc3321f587f5a8efea8256aeb935a905df2da5f5a901cd8f7355a75e3832da3",
        "source": "amazon-inspector",
        "versions": [
          "0.0.5"
        ]
      }
    ]
  },
  "details": "\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (acc3321f587f5a8efea8256aeb935a905df2da5f5a901cd8f7355a75e3832da3)\nThe package presents itself as an Activepieces connector for Google BigQuery but src/index.js combines require(\"child_process\"), an OS reconnaissance command (ping), and multiple POST calls to an external endpoint at module load. This is the network-command-exfiltration + hardcoded-C2 shape rather than a BigQuery client: a legitimate BigQuery piece would call googleapis / @google-cloud/bigquery, not shell out and POST host data to an unrelated destination. Loading the module therefore executes attacker-controlled behavior against the installer\u0027s host with no relation to the advertised BigQuery functionality.\n",
  "id": "MAL-2026-13394",
  "modified": "2026-08-06T14:21:50.599246504Z",
  "published": "2026-08-06T12:57:30Z",
  "references": [
    {
      "type": "PACKAGE",
      "url": "https://www.npmjs.com/package/@activepieces/piece-google-bigquery/v/0.0.6"
    },
    {
      "type": "PACKAGE",
      "url": "https://www.npmjs.com/package/@activepieces/piece-google-bigquery/v/0.0.5"
    }
  ],
  "schema_version": "1.7.4",
  "summary": "Malicious code in @activepieces/piece-google-bigquery (npm)"
}