google-calendar

The fragment appears to be an OAuth helper for Google Calendar rather than malware. Its primary security concern is that refresh tokens are delegated to a hardcoded third-party cloud function, which must be trusted as part of the authentication design. Additional defects include inconsistent OAuth state handling, token exposure through query parameters and the token-printing command, unescaped callback error HTML, and a missing argument to wfile.write(). No clear malicious payload, system-data theft, command execution, persistence, or obfuscation is present.

SUSPICIOUS. The core capabilities fit a Google Calendar skill and token storage in the system keyring is proportionate, but install provenance is under-documented and the stated token refresh path via "Google's cloud function" is not clearly aligned with standard Google OAuth flows. Risk is moderate due to ambiguous data flow and the ability to take real-world calendar actions, not because of confirmed malware.