Description

The package presents itself as an Activepieces connector for Google BigQuery but src/index.js combines require("child_process"), an OS reconnaissance command (ping), and multiple POST calls to an external endpoint at module load. This is the network-command-exfiltration + hardcoded-C2 shape rather than a BigQuery client: a legitimate BigQuery piece would call googleapis / @google-cloud/bigquery, not shell out and POST host data to an unrelated destination. Loading the module therefore executes attacker-controlled behavior against the installer's host with no relation to the advertised BigQuery functionality.

Mitigation

Aliases