The package @activepieces/piece-google-bigquery, specifically versions 0.0.5 and 0.0.6, masquerades as a Google BigQuery connector but contains malicious code. The src/index.js file requires the Node.js child_process module to execute OS commands such as ping for reconnaissance. It then sends collected host information via multiple POST requests to a hardcoded external endpoint, indicative of command-and-control communication. This malicious behavior is triggered immediately upon module loading, diverging from legitimate BigQuery clients that use official Google APIs. There is no indication of a patch or remediation provided by the vendor.

Loading the affected package versions results in execution of attacker-controlled commands on the host system, including OS reconnaissance and data exfiltration to an external server. This compromises the confidentiality and integrity of the host environment where the package is installed. The malicious activity occurs without user consent or further action, increasing risk of undetected compromise.

No official patch or remediation is currently documented. Users should avoid installing or using versions 0.0.5 and 0.0.6 of @activepieces/piece-google-bigquery. Remove these versions from existing environments and replace them with verified, legitimate packages. Monitor for any unexpected network activity related to this package and audit systems for potential compromise.