Sato Hub
← Sato Check

Sato Check · Package

@drift-labs/sdk

npm:@drift-labs/sdk · v2.163.0-beta.13 · sha256:f19feaa7b0f5 · as of 2026-09-26

Does it take your key?
traced
It asks for a private key or seed phrase in its setup.
Our static read of the published artifact found it.
Does your key leave?
observed
Not observed — no planted key left during install and start-up, under our test conditions — code paths that only run later, or only on a trigger, are not covered.
We ran it with planted test keys and saw it.
Can it move funds on its own?
no evidence
Unknown — we could not read what it exposes.
No evidence line on file for this question yet.
What changed?
no evidence
First profile of this subject — nothing to compare yet.
No evidence line on file for this question yet.

Is this your project? Respond →Dispute this reading

Hosts contacted

HostWhenRoleEvidence
api.jup.agcodeothertraced
api.marinade.financecodeothertraced
api.titan.exchangecodeothertraced
api2.marinade.financecodeothertraced
docs.solana.comcoderpctraced
history.pyth-lazer.dourolabs.appcodeothertraced
kobe.mainnet.jito.networkcodeothertraced
lite-api.jup.agcodeothertraced
master.swift.drift.tradecodevendortraced
stake.solblaze.orgcodeothertraced
swift.drift.tradecodevendortraced
registry.npmjs.orginstallregistryobserved
nodejs.orginstallotherobserved
Evidence (15 lines)
  • observedO-hosts2026-09-25

    registry.npmjs.org was contacted during install (registry).

    sandbox:obs_3a630d1d7d296588

  • observedO-hosts2026-09-25

    nodejs.org was contacted during install (other).

    sandbox:obs_3a630d1d7d296588

  • tracedT-hosts2026-09-26

    api.jup.ag appears in shipped code (other).

    lib/browser/jupiter/jupiterClient.js

  • tracedT-hosts2026-09-26

    api.marinade.finance appears in shipped code (other).

    lib/browser/math/superStake.js

  • tracedT-hosts2026-09-26

    api.titan.exchange appears in shipped code (other).

    lib/browser/titan/titanClient.js

  • tracedT-hosts2026-09-26

    api2.marinade.finance appears in shipped code (other).

    lib/browser/math/superStake.js

  • tracedT-hosts2026-09-26

    docs.solana.com appears in shipped code (rpc).

    lib/browser/pyth/types.js

  • tracedT-hosts2026-09-26

    history.pyth-lazer.dourolabs.app appears in shipped code (other).

    lib/browser/pyth/pythLazerSubscriber.js

  • tracedT-hosts2026-09-26

    kobe.mainnet.jito.network appears in shipped code (other).

    lib/browser/math/superStake.js

  • tracedT-hosts2026-09-26

    lite-api.jup.ag appears in shipped code (other).

    lib/browser/jupiter/jupiterClient.js

  • tracedT-hosts2026-09-26

    master.swift.drift.trade appears in shipped code (vendor).

    lib/browser/swift/swiftOrderSubscriber.js

  • tracedT-hosts2026-09-26

    stake.solblaze.org appears in shipped code (other).

    lib/browser/math/superStake.js

  • tracedT-hosts2026-09-26

    swift.drift.trade appears in shipped code (vendor).

    lib/browser/swift/swiftOrderSubscriber.js

  • tracedT-key-handling2026-09-26

    Turns key material it is GIVEN into an account or signer (Keypair.fromSecretKey()); no read of a key from the environment or a key file was found. A signing library does this.

    lib/browser/keypair.js:26

  • declaredD-env-key2026-09-26

    Setup names BOT_PRIVATE_KEY as something to provide.

    @drift-labs/sdk@2.163.0-beta.13/README.md

Limits

  • Traced analysis follows flows inside one module only; a key handed from one module to another is not followed.
  • Key egress not observed during install and start-up, under our test conditions — code paths that only run later, or only on a trigger, are not covered.
  • No tool inventory was available, so fund actions were not read.
  • Sandbox: DNS queries made directly by the target are not logged; hosts are recorded from proxied HTTP(S) requests and CONNECTs..
  • Sandbox: Code that ignores HTTP(S)_PROXY has no route out of the sandbox, so its attempts are not captured..
  • Traced: 460 code files; parsed 400, entry points first.

A profile describes what we read and ran, with dates. It is not a safety rating, an audit or an endorsement, and "not found" is not "not there".

sato.custody/v1 · custody-1

Maintain this project? Respond to this reading

Loading sign-in…