No confirmed attack surface beyond user-invoked Ethereum utility functions. Installation has no lifecycle execution, and runtime modules perform local hashing, serialization, address, and ECDSA operations.
Static reason
No blocking static signals were detected.
Trigger
Consumer imports and explicitly calls exported utility functions.
Impact
No credential collection, file mutation, network communication, persistence, or remote code execution established.
Mechanism
Local Ethereum cryptography and byte/serialization utilities.
Rationale
Source inspection shows a conventional Ethereum utility library with no install-time execution or concrete malicious behavior. Scanner-adjacent entrypoint imports are package-aligned local exports and crypto dependencies.
Evidence
package.jsonsrc/index.tssrc/hash.tssrc/signature.tssrc/account.tsdist/index.js