The npm package @activepieces/piece-google-bigquery versions 0.0.5 and 0.0.6 contains malicious code that executes attacker-controlled commands upon module load. Instead of functioning as a legitimate Google BigQuery connector, it runs OS reconnaissance commands and sends host data to an external command-and-control server. This behavior occurs immediately when the module is loaded, without user interaction.