NIST deprecates RSA-2048 from 2030. Find every one of them before attackers do.
Malicious package

@activepieces/piece-google-formsnpm

Advisory published Updated

@activepieces/piece-google-forms is a confirmed malicious npm package (MAL-2026-13396) that steals credentials and exfiltrates sensitive data (malicious versions 0.5.5, 0.5.6, 0.5.7). Do not install it — remove it immediately and rotate any exposed credentials.

Malicious code in @activepieces/piece-google-forms (npm)

MAL-2026-13396
Immediate action
Remove the package, then rotate any secrets the build/runtime could reach.
npm uninstall @activepieces/piece-google-forms

What this malware does

The published tarball for @activepieces/piece-google-forms 0.5.7 contains src/index.js which imports child_process, invokes ping-style OS command execution (line 38), and issues hardcoded HTTP POST requests (lines 25, 38). This co-occurrence — child_process command execution combined with network POST to a hardcoded destination inside a piece module that is loaded when the Activepieces host requires it — matches the shape of an installer-side command-execution and data-exfiltration payload rather than the ordinary Google Forms API integration the package advertises. A legitimate Google Forms piece would call the Google Forms REST API via the piece framework's HTTP helpers; it would not shell out or ping remote hosts. The package's name and scope also resemble the legitimate @activepieces/* piece ecosystem, which increases the likelihood that the release is a lookalike or a compromised publish rather than a benign integration.

Malicious versions

3 flagged
0.5.50.5.60.5.7

Indicators of compromise (SHA-256)

06d347d6252c2a1bb21b4318c0a319be36d60a95b4146d91108cee13d52c5759
c7434d6602ed97900763a5588c6ce5588cc4943751f1b52db1f854084f1b321f
b4658e5ce47d286606492b92743e913f4cf585ade6a95bd9ae26a46ddcb1672f

Detection & response playbook

Credential / info stealer

  1. Find it

    Search your lockfiles and build artifacts for @activepieces/piece-google-forms (3 malicious versions).

  2. If you installed it — respond

    @activepieces/piece-google-forms is built to steal secrets, so assume every credential the build or runtime could read is compromised. Remove it from your project and lockfile, then rotate ALL exposed secrets — npm/registry tokens, cloud keys, CI/CD secrets, SSH keys, and any .env values — from a known-clean machine. Audit logs for unauthorized use of those credentials.

  3. Did it already run?

    If @activepieces/piece-google-forms was installed, its post-install payload may already have run. Removing the package does not undo that — check outbound connections and credential use from the install window onward.

Frequently asked questions

No. @activepieces/piece-google-forms on npm has been identified as a malicious package (versions 0.5.5, 0.5.6, 0.5.7 flagged). It should be removed immediately — do not install or keep it in your dependency tree.

Campaign

IN-MAL-2026-016274IN-MAL-2026-016381IN-MAL-2026-016385

References

Credits

  • Amazon Inspector · finder

Detect & block this

O3 blocks @activepieces/piece-google-forms-class packages before install and in CI — and if it already ran, its runtime egress monitoring catches the credential exfiltration and severs the channel.

Malware detection Runtime egress monitoring

Explore

All malware advisories How O3 detects malware Vulnerability database
@activepieces/piece-google-forms (npm) malicious package — MAL-2026-13396 | O3 Security