pptx
Audited by Socket on Jul 17, 2026
1 alert found:
SecurityThis module is designed to run LibreOffice but also includes a conditional mechanism to compile a native shared library at runtime and inject it into the `soffice` process via LD_PRELOAD. That is a high-impact behavior commonly associated with hooking/instrumentation, and in supply-chain contexts it is also consistent with sabotage/backdoor capability. The provided snippet is incomplete because the _SHIM_SOURCE payload content is missing, so the exact maliciousness cannot be confirmed from this fragment alone; however, the presence of runtime gcc compilation + LD_PRELOAD injection warrants treating the package as high security risk until the full shim source/provenance and runtime behavior are independently audited in a sandbox.