meta-decompile

No direct evidence of intentional malware (no exec/eval, subprocesses, network calls, or credential exfiltration) is present in this module. The main security risk is that it performs repeated lxml XML parsing without visible hardening and then expands the number of local XML reads using filenames/paths derived from untrusted XML content (obj_name and, for ExternalDataSource, tbl_name). If an attacker can influence the input XML or related local files, this could lead to XML parser attacks (XXE/entity expansion/DoS) and unintended local file content disclosure via computed path traversal. Treat the module as security-sensitive and add hardened XML parser configuration and strict validation/sanitization of path components.