fittings-ndc-package-lookup

Suspicious. The stated purpose is plausible, but the actual footprint is larger than necessary: a public FDA lookup is mediated by a third-party paid gateway, requires executing a remotely fetched script, and can use a plaintext wallet private key to authorize spending. This is not confirmed malware, but it carries high supply-chain and credential-handling risk.