@activepieces/piece-google-bigquery @0.0.6

Summary

The package presents itself as an Activepieces connector for Google BigQuery but src/index.js combines require("child_process"), an OS reconnaissance command (ping), and multiple POST calls to an external endpoint at module load. This is the network-command-exfiltration + hardcoded-C2 shape rather than a BigQuery client: a legitimate BigQuery piece would call googleapis / @google-cloud/bigquery, not shell out and POST host data to an unrelated destination. Loading the module therefore executes attacker-controlled behavior against the installer's host with no relation to the advertised BigQuery functionality.

Source: amazon-inspector (acc3321f587f5a8efea8256aeb935a905df2da5f5a901cd8f7355a75e3832da3)