The published tarball for @activepieces/piece-google-forms versions 0.5.5 through 0.5.7 includes src/index.js that imports the Node.js child_process module to execute ping-style OS commands and issues hardcoded HTTP POST requests to a fixed external endpoint. This combination of command execution and network communication within a piece module loaded by the Activepieces host is indicative of an installer-side malicious payload designed for command execution and data exfiltration. Legitimate Google Forms integration would use the Google Forms REST API via HTTP helpers, not shell commands or hardcoded network calls. The package's naming similarity to the official @activepieces pieces increases the risk of supply chain attack or malicious package impersonation.

Systems that install or run these specific versions of @activepieces/piece-google-forms may execute arbitrary OS commands and transmit data to an attacker-controlled server, potentially leading to unauthorized command execution and data leakage. This compromises the integrity and confidentiality of the affected environment.

No official patch or remediation guidance is provided in the available data. Users should immediately avoid using versions 0.5.5, 0.5.6, and 0.5.7 of @activepieces/piece-google-forms. Verify package integrity and source before installation, and consider removing these versions if already installed. Monitor for updates or advisories from the package maintainers or npm regarding this issue. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.