busco-phylogeny

No explicit malware behavior (e.g., reverse shells, network exfiltration, credential theft, or persistence) is evident in this wrapper itself. The dominant risk is security engineering: it uses eval to execute a constructed command string that embeds user-controlled CLI/array-mode values without quoting/escaping or strict validation, enabling potential command injection. Additionally, it resolves and executes Aliscore.02.2.pl from PATH first, which can become a supply-chain execution risk if the environment is not trusted. Treat this wrapper as unsafe for untrusted inputs until eval is removed and arguments are safely passed to perl (e.g., via arrays) and Aliscore is pinned to a verified path.

No direct evidence of overt malware (e.g., data theft, network exfiltration, persistence) is present in the visible fragment. However, the wrapper contains a significant supply-chain/workflow security weakness: it executes a dynamically constructed command using eval ${ALICUT_CMD}, where ALICUT_CMD is formed from ALICUT_SCRIPT and especially ALICUT_OPTS. If any of these are influenced by untrusted input, the wrapper can be turned into arbitrary shell command execution. Additional integrity risks include symlink creation with input-derived names and non-deterministic output file selection via wildcard globbing and taking the first match.