xlsx-win

This module is an Excel COM automation wrapper. It does not show direct malware indicators (no network/exfiltration/credential theft visible). However, it introduces a meaningful security risk by explicitly setting Excel AutomationSecurity to ForceDisable and suppressing alerts/prompts, then opening and saving workbooks using caller-provided file paths without validation. If an attacker can influence workbookPath/outputPath or the workbook contents, this increases the likelihood of harmful spreadsheet content being processed and of unintended filesystem writes/overwrites. Availability risk is also present due to an indefinite wait for Excel process termination.

No direct evidence of backdoor/exfiltration/persistence is present in this fragment. However, the code is security-sensitive: it writes caller-controlled R1C1 formula strings directly into an Excel workbook and then triggers full recalculation and pivot refresh, which can amplify impact if attackers can influence calculated_formulas and/or the seed template. Additionally, it suppresses Excel alerts and may forcibly kill an Excel-related process on timeout, creating operational risk. Treat this as potentially dangerous automation when inputs/templates are not fully trusted.

This artifact is a workflow/fixture-style configuration that instructs a runner to execute a hardcoded destructive shell command ('rm -rf /'). If any automation honors the shell_command field, it would irreversibly wipe the host filesystem. The workbook_path open step implies a normal file read operation, but the dominant security concern is the explicit mass-deletion command with no visible safeguards.

This module is not evidence of data theft, persistence, or network activity; however, it provides a high-impact process execution primitive (create arbitrary process in a suspended state and later resume it) with no executable/argument allowlisting. The primary security concern is misuse: if upstream code passes untrusted or insufficiently constrained executable/arguments, the module enables arbitrary process execution (potentially stealthier due to CREATE_NO_WINDOW and staging due to CREATE_SUSPENDED).