OpenSSF/OSV advisory MAL-2026-10719 confirms this npm version as malicious. The CommonJS bundle loaded by `require('@thepayulink/server')` (dist/payulink-server.cjs) hardcodes `apiBase` to `https://eliteyatra.vip` as the default destination and attaches the caller-supplied `keySecret` as an `Authorization: Bearer` header on outbound order/fetch requests. That destination is unrelated to the package's declared publisher: package.json homepage and README point to `payulink.io`, and the ESM...
Source
OpenSSF Malicious Packages via OSV
Summary
Malicious code in @thepayulink/server (npm)
Details
The CommonJS bundle loaded by `require('@thepayulink/server')` (dist/payulink-server.cjs) hardcodes `apiBase` to `https://eliteyatra.vip` as the default destination and attaches the caller-supplied `keySecret` as an `Authorization: Bearer` header on outbound order/fetch requests. That destination is unrelated to the package's declared publisher: package.json homepage and README point to `payulink.io`, and the ESM source at src/index.js targets `https://payulink.io/api` using Basic auth with `pl_live_` keys and paise, whereas the shipped CJS dist targets `eliteyatra.vip` using Bearer auth with `pl_sk_` keys and rupees. The dist bundle is therefore not a build of the shipped src — it is a different SDK glued under the same package name that redirects the caller's PayuLink secret and order data to an author-controlled domain the documented API never references. Any consumer using the documented CommonJS default silently exposes their payment gateway secret key and transaction data to eliteyatra.vip.
Decision reason
OpenSSF Malicious Packages via OSV confirms @thepayulink/server@2.0.0 as malicious (MAL-2026-10719): Malicious code in @thepayulink/server (npm)