xlsx

SUSPICIOUS: The spreadsheet functionality is largely coherent and locally scoped, but the required recalc.py helper is an unverifiable dependency that executes code and sets up LibreOffice macros without any provenance or source disclosure. No credential harvesting or exfiltration is evident, so this is better classified as high supply-chain risk than confirmed malware.