The only evidence is a YARA rule match semicolon_relative_path_high with low confidence. This rule matches relative paths in the file, which could be legitimate depending on the context. Without further evidence, it's not possible to classify this package as malware.