hwpx-core
Warn
Audited by Socket on Apr 3, 2026
1 alert found:
AnomalyAnomalyscripts/office/pack.py
LOWAnomalyLOW
scripts/office/pack.py
This is primarily a deterministic packer/repackager for HWPX (ZIP) content with optional rewriting of specific Contents/*section*.xml files. The strongest security concern is that it dynamically loads and executes a local sibling module (cell_writer.py) during the transformation path, and it suppresses transformation exceptions. The fragment shows no direct network exfiltration, subprocess usage, credential access, or file-damaging logic by itself, so confirmed malware is not indicated here; however, the dynamic module execution makes this a plausible supply-chain/sabotage review point that requires inspecting cell_writer.py for malicious behavior.
Confidence: 72%Severity: 58%
Audit Metadata