{"answers":{"affected":"1 open source package ship an affected version, including @activepieces/piece-google-forms.","exploited":"There is no known exploitation of MAL-2026-13396 in the wild and no public exploit code.","fix":"Remove the package from your dependencies and lockfiles, then rotate any secrets on machines where it was installed.","what":"MAL-2026-13396 is a malicious package in @activepieces/piece-google-forms, published on 6 Aug 2026."},"fix_prompt":"MAL-2026-13396 is a malicious package: @activepieces/piece-google-forms (npm). Every version was published to cause harm.\n\nTask:\n1. Search this repository's dependency manifests and lockfiles for the package, including transitive dependencies.\n2. If it is present, remove it, regenerate the lockfile with the project's package manager, and replace whatever it was used for.\n3. List any CI runners, developer machines or containers that installed it, so their secrets can be rotated.\n4. If the package is not used anywhere, say so and change nothing.\n\nReference: https://insights.sbomify.com/MAL-2026-13396/ (Markdown: https://insights.sbomify.com/MAL-2026-13396/index.md)","id":"MAL-2026-13396","markdown":"https://insights.sbomify.com/MAL-2026-13396/index.md","name":"MAL-2026-13396","record":{"aliases":[],"analysis":null,"analysis_generated_by":null,"assigner":null,"cpe":[],"cvss":{"score":null,"severity":null,"source":null,"vector":null,"version":null},"cwes":[],"description":"The published tarball for @activepieces/piece-google-forms 0.5.7 contains src/index.js which imports child_process, invokes ping-style OS command execution (line 38), and issues hardcoded HTTP POST requests (lines 25, 38). This co-occurrence — child_process command execution combined with network POST to a hardcoded destination inside a piece module that is loaded when the Activepieces host requires it — matches the shape of an installer-side command-execution and data-exfiltration payload rather than the ordinary Google Forms API integration the package advertises. A legitimate Google Forms piece would call the Google Forms REST API via the piece framework's HTTP helpers; it would not shell out or ping remote hosts. The package's name and scope also resemble the legitimate @activepieces/* piece ecosystem, which increases the likelihood that the release is a lookalike or a compromised publish rather than a benign integration.","ecosystems":["npm"],"exploits":{"exploitdb":null,"first_seen":null,"github_poc":null,"max_poc_stars":null,"metasploit":null,"nuclei":null,"refs":[],"tier":null},"has_fix":false,"headline":"Malicious code in @activepieces/piece-google-forms (npm)","id":"MAL-2026-13396","indexable":true,"kev":null,"kind":"malicious","links":{"ecosystem":"npm","product":null,"products":[],"type":null,"year":"2026"},"n_packages":1,"n_references":null,"packages":[{"ecosystem":"npm","fixed":[],"introduced":[],"last_affected":[],"package":"@activepieces/piece-google-forms","purl":"pkg:npm/%40activepieces/piece-google-forms","source":"MAL-2026-13396"}],"products":null,"published":"2026-08-06","related":[],"sources":[{"class":"attribution","licence":"Apache-2.0","name":"OpenSSF Malicious Packages","prefix":"MAL"}],"ssvc":{"automatable":null,"exploitation":null,"technical_impact":null},"state":null,"updated":null,"vendors":null},"summary":null,"url":"https://insights.sbomify.com/MAL-2026-13396/"}