veil

This module implements Base-chain balance checks and Veil SDK helper commands, with no clear evidence of deliberate malware or direct credential exfiltration. Its deposit handler broadcasts ETH to the hardcoded validator rather than the selected pool and does not perform the described ZK commitment flow, creating a material risk of unintended or unrecoverable transfers. The npx-invoked @veil-cash/sdk receives VEIL_KEY for SDK operations, so its provenance and behavior are security-critical. Severity is a security warning, primarily due to the transaction destination behavior and execution of a credential-accessing external package.