pptx

Warn

Audited by Socket on Jul 17, 2026

1 alert found:

Security
SecurityMEDIUM
scripts/office/soffice.py

This module is designed to run LibreOffice but also includes a conditional mechanism to compile a native shared library at runtime and inject it into the `soffice` process via LD_PRELOAD. That is a high-impact behavior commonly associated with hooking/instrumentation, and in supply-chain contexts it is also consistent with sabotage/backdoor capability. The provided snippet is incomplete because the _SHIM_SOURCE payload content is missing, so the exact maliciousness cannot be confirmed from this fragment alone; however, the presence of runtime gcc compilation + LD_PRELOAD injection warrants treating the package as high security risk until the full shim source/provenance and runtime behavior are independently audited in a sandbox.

Confidence: 62%Severity: 93%
Audit Metadata
Analyzed At
Jul 17, 2026, 09:51 PM
Package URL
pkg:socket/skills-sh/guanyang%2Fopen-agent-hub%2Fpptx%2F@18194246a64c04981a69e3d24749e0cd9e046ea1fe300df3c7ac5b6161264677
Security Audit — socket — pptx