sati-sdk

No clear indicators of intentional malware (e.g., exfiltration, backdoor payloads, or suspicious network activity beyond Solana RPC/WSS) are present in this module. The dominant security risk is the use of execSync with interpolated shell command strings derived from CLI arguments and environment variables; if an attacker can influence those values in the execution environment, command injection is plausible. Treat this as a moderate security alert for deployment/CI contexts, and ensure inputs are trusted and/or refactor execSync to spawn with argument arrays and strict validation/escaping.

This fragment is declarative JSON configuration/metadata with no executable or malicious behavior visible. The primary concern is supply-chain exposure of credential/authority-like values hardcoded into a distributed artifact (notably config.credential and authority). Without the surrounding code, it is not possible to confirm active malware or actual exfiltration, but the embedded secret/authorization material represents a moderate-to-high security risk if it is sensitive and not meant to be public.

No clear malware/backdoor logic is evident in this module (no dynamic execution or stealth behavior). The primary security concern is operational/credential risk: the script hardcodes and transmits an external RPC/WebSocket API key in URLs, embeds a hardcoded base58 value used to derive the transfer destination, and reads a local deployer private key to sign transactions that register and transfer ownership. Treat as high-risk and ensure secrets are redacted, keys are handled securely, and the script is not accidentally run against unintended environments (e.g., wrong network/keys).