q-multimodal

No clear evidence of overt malware (no obfuscation, no backdoor/persistence, no subprocesses, no keylogging/clipboard theft). However, the code dynamically imports and executes pipeline_config.py from an environment-controlled path (exec_module), which is an arbitrary code execution/supply-chain risk if the config file/path can be tampered with. Additionally, the module intentionally uploads media/prompt content to Google Gemini, which is expected for the pipeline but represents network data transmission.