The npm package @activepieces/piece-google-contacts versions 0.4.7 and 0.4.8 contains malicious code that executes shell commands and sends network POST requests to hardcoded endpoints. This behavior is inconsistent with its declared purpose as a Google Contacts API client and indicates host reconnaissance and outbound beaconing activity. No official patch or remediation guidance is currently available.