monte-carlo-valuation

This module itself is primarily a Monte Carlo/valuation input-wrangling layer, with strong validation of numeric/distribution parameters. However, it contains a critical supply-chain execution risk: it dynamically imports and executes a Python module from a path supplied (optionally) by the untrusted JSON payload via 'dcf_path', then calls module.value() with attacker-influenced inputs. No direct malicious behaviors (network/subprocess/secret theft) are evident in the fragment, but the design enables arbitrary code execution if the engine path is not strictly controlled/trusted.