docx

Warn

Audited by Socket on Jul 17, 2026

1 alert found:

Security
SecurityMEDIUM
scripts/office/soffice.py

This module is designed to run LibreOffice but also includes a conditional mechanism to compile a native shared library at runtime and inject it into the `soffice` process via LD_PRELOAD. That is a high-impact behavior commonly associated with hooking/instrumentation, and in supply-chain contexts it is also consistent with sabotage/backdoor capability. The provided snippet is incomplete because the _SHIM_SOURCE payload content is missing, so the exact maliciousness cannot be confirmed from this fragment alone; however, the presence of runtime gcc compilation + LD_PRELOAD injection warrants treating the package as high security risk until the full shim source/provenance and runtime behavior are independently audited in a sandbox.

Confidence: 62%Severity: 93%
Audit Metadata
Analyzed At
Jul 17, 2026, 09:51 PM
Package URL
pkg:socket/skills-sh/guanyang%2Fopen-agent-hub%2Fdocx%2F@d3c3b718e1d0235fd2b69a73a29d40d8abd64b0612958b494eb61d4c5d46d277
Security Audit — socket — docx