mesh-wallet

The fragment does not indicate malicious supply-chain behavior. It documents legitimate Cardano wallet signing and transaction submission APIs. The main security concerns are unsafe example deployment patterns: an unauthenticated Express endpoint can cause a server-held wallet to sign arbitrary recipient and amount values, and verifySignature does not actually compare the signing address with expectedAddress. These are significant application-level risks requiring authentication, authorization, validation, transaction limits, and proper address binding, but they are not evidence of malware in the library.