MAL-2026-13394

    Dashboard / Malicious Package / MAL-2026-13394

    MAL-2026-13394

    Published: 6 Aug 2026Last Modified: 6 Aug 2026

    Summary: Malicious code in @activepieces/piece-google-bigquery (npm)

    Details: Source: amazon-inspector (acc3321f587f5a8efea8256aeb935a905df2da5f5a901cd8f7355a75e3832da3) The package presents itself as an Activepieces connector for Google BigQuery but src/index.js combines require("child_process"), an OS reconnaissance command (ping), and multiple POST calls to an external endpoint at module load. This is the network-command-exfiltration + hardcoded-C2 shape rather than a BigQuery client: a legitimate BigQuery piece would call googleapis / @google-cloud/bigquery, not shell out and POST host data to an unrelated destination. Loading the module therefore executes attacker-controlled behavior against the installer's host with no relation to the advertised BigQuery functionality.

    References: https://www.npmjs.com/package/@activepieces/piece-google-bigquery/v/0.0.6, https://www.npmjs.com/package/@activepieces/piece-google-bigquery/v/0.0.5

    Affected packages

    Package

    Name: @activepieces/piece-google-bigquery

    Purl: pkg:npm/%40activepieces/piece-google-bigquery

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    0.0.6
    0.0.5
    MAL-2026-13394 | CVE-DB