near-intents

No clear evidence of in-module malware/backdoor behavior is present in this snippet. However, it is security-sensitive: it hardcodes a third-party API endpoint and uses API-returned depositAddress/amountIn (and API-provided token contractAddress for ERC-20 transfers) directly to construct wallet transactions. If the API, token metadata, or quote data is compromised or malicious, this could lead to fraudulent swaps where users sign transfers to attacker-controlled destinations. Treat this as a high-trust integration/validation risk rather than classic injected malware.