xlsx

The visible fragment is an audit report, not the implementation. It documents a serious behavior in the larger package: recalc.py reportedly creates a hidden LibreOffice profile directory and overwrites Module1.xba with bundled macro content, enabling persistent executable macro installation and possible destruction of user macros. This is inconsistent with a narrowly scoped recalculation utility and should be treated as a high security risk pending inspection of the actual script and macro payload. No direct exfiltration or command-injection behavior is visible in this fragment, and the Markdown backtick findings are false positives.

This module is primarily a LibreOffice headless recalculation wrapper, but it also conditionally writes a LibreOffice Basic macro (Module1.xba) into the user’s LibreOffice profile directory and then invokes it via vnd.sun.star.script. That combination (persistent host modification + Office/LibreOffice macro execution) is a strong security red flag for supply-chain risk because the macro payload can potentially execute arbitrary actions in the LibreOffice process context. The provided fragment is incomplete around macro_content, so the exact payload cannot be verified here; treat this as high-risk and require inspection of the actual macro content and packaging process, ideally in a sandbox.