The @activepieces/piece-google-contacts npm package in versions 0.4.7 and 0.4.8 imports the Node.js child_process module to execute shell commands and issues POST requests to hardcoded network endpoints, alongside invoking system ping commands. These actions deviate from legitimate OAuth-based Google Contacts API client behavior, suggesting the package performs host reconnaissance and outbound beaconing, indicative of malicious intent rather than legitimate functionality.

The malicious code can execute arbitrary shell commands on the host system and communicate with external endpoints, potentially enabling unauthorized data exfiltration, system reconnaissance, or further compromise of the affected environment. Users relying on this package may unknowingly expose their systems to remote control or data leakage.

No official patch or remediation guidance is currently provided. Users should immediately discontinue use of versions 0.4.7 and 0.4.8 of @activepieces/piece-google-contacts and consider removing the package from their environments. Monitor for updates from the package maintainers or security advisories for any forthcoming fixes or official recommendations.