Is @activepieces/piece-google-forms safe?

The published tarball for @activepieces/piece-google-forms 0.5.7 contains src/index.js which imports child_process, invokes ping-style OS command execution (line 38), and issues hardcoded HTTP POST requests (lines 25, 38). This co-occurrence — child_process command execution combined with network POST to a hardcoded destination inside a piece module that is loaded when the Activepieces host requires it — matches the shape of an installer-side command-execution and data-exfiltration payload rather than the ordinary Google Forms API integration the package advertises. A legitimate Google Forms piece would call the Google Forms REST API via the piece framework's HTTP helpers; it would not shell out or ping remote hosts. The package's name and scope also resemble the legitimate @activepieces/* piece ecosystem, which increases the likelihood that the release is a lookalike or a compromised publish rather than a benign integration.

Reported by Amazon Inspector via OSV.

Malicious

0.5.7, 0.5.6, 0.5.5

Move to

0.7.4 newest 0.x release, no known advisory

If one of these versions was installed, remove it and treat the credentials, tokens and SSH keys on that machine as exposed: rotate them. Check CI runners and container images that installed it too.

npm install @activepieces/piece-google-forms@0.7.4

OSV recordreferencereferencereference