stripe-stack

No clear malware or supply-chain sabotage is present. The code implements a legitimate credit system but has high-impact authorization and accounting weaknesses: client-controlled user identity, missing webhook idempotency/payment validation, non-atomic deductions, insufficient validation and authorization around add_credits, and prepayment deduction without failure compensation. These issues should be fixed before production use.