erc-8004

Not overtly malicious, but contains a critical code-injection vulnerability: REGISTRATION_URL is interpolated directly into node -e JavaScript without escaping, enabling arbitrary JavaScript execution if an attacker controls REGISTRATION_URL. Combined with the use of an external, unverified bankr CLI, this results in a meaningful supply-chain and execution risk. Fix by removing direct interpolation (use environment variable or file input), validate/sanitize REGISTRATION_URL, and verify bankr binary integrity before use.