xlsx

Warn

Audited by Socket on Jul 17, 2026

1 alert found:

Security
SecurityMEDIUM
scripts/office/soffice.py

This module is designed to run LibreOffice but also includes a conditional mechanism to compile a native shared library at runtime and inject it into the `soffice` process via LD_PRELOAD. That is a high-impact behavior commonly associated with hooking/instrumentation, and in supply-chain contexts it is also consistent with sabotage/backdoor capability. The provided snippet is incomplete because the _SHIM_SOURCE payload content is missing, so the exact maliciousness cannot be confirmed from this fragment alone; however, the presence of runtime gcc compilation + LD_PRELOAD injection warrants treating the package as high security risk until the full shim source/provenance and runtime behavior are independently audited in a sandbox.

Confidence: 62%Severity: 93%
Audit Metadata
Analyzed At
Jul 17, 2026, 09:50 PM
Package URL
pkg:socket/skills-sh/guanyang%2Fopen-agent-hub%2Fxlsx%2F@5e97eff30da199507a251ca009ce154df8151fa7c53d4995acfea5068eaeb013
Security Audit — socket — xlsx