valid-iban

SUSPICIOUS. The stated purpose matches IBAN validation, but the footprint is broader than necessary because it relies on a paid remote service and an unpinned downloaded helper script that can receive a plaintext private key for real-money authorization. Data flows stay on the stated service domain, so this is not clearly malicious, but the supply-chain and wallet-key exposure make it medium-high risk.