registry / Malware / woo-elevell

woo-elevell

The **woo-elevell SDK** is a headless e-commerce integration framework for React and WordPress/WooCommerce. It bridges server-rendered WooCommerce environments with dynamic React frontends, providing server-side runtime hydration via `window.__ELEVELL__`,

This report shows the evidence for woo-elevell@0.92.0. 1 of 5 known versions is blocked or flagged. The newest version, 0.94.0, is allowed. See all versions.

AI Security Review

scanned 6d ago · by lpm-firewall-ai

The order payment hook initiates payment automatically on page mount, without requiring a shopper click. Because this can cause a valid order to be charged without a distinct payment action, it meets the automatic-spending rule.

Static reason

No blocking static signals were detected.

Trigger

A page using useOrderPay mounts with a valid order ID and order key.

Impact

A valid order payment may be initiated and funds charged without a separate shopper action on the payment page.

Mechanism

The hook fetches order details and calls the payment flow without a user click. That flow submits the order credentials and payment method to the store gateway; Razorpay orders also open the payment checkout automatically.

Attack narrative

When an order-pay page using useOrderPay mounts, the hook fetches the order and automatically starts payment with its order ID, key, and payment method. The payment request is sent through the store gateway, and Razorpay checkout is opened automatically for Razorpay orders.

AI rationale

Evidence

src/useOrderPay.jssrc/checkout.jssrc/client.js

Network endpoints2

/wp-json/elevell/v1/storecheckout.razorpay.com/v1/checkout.js

Decision evidence

public snapshot

AI called this Malicious at 91.0% confidence as Malware with low false-positive risk.

Evidence for block

When useOrderPay mounts and receives order data, it calls startPayment automatically without waiting for a shopper click.
The payment flow submits the order ID, order key, and payment method to checkout.orderPay.pay.
The SDK sends gateway requests to its configured endpoint, which defaults to the same-origin WordPress store route.

Evidence against

The package is a WooCommerce and React e-commerce SDK, so order payment support is part of its stated purpose.
Payment requests go through the configured store gateway; Razorpay’s checkout script is loaded from its official checkout host.

Behavioral surface

Source

FilesystemNetwork

Supply chain

UrlStrings

Manifest

NoLicense

scanned 44 file(s), 151 KB of source, external domains: checkout.razorpay.com

Source & flagged code

5 flagged

src/useOrderPay.jsView file

208const razorpayReady = loadRazorpay(); checkout.getOrderPay(resolvedOrderId, resolvedOrderKey) .then(async (orderData) => { if (!active) return; setOrder(orderData); const method = orderData?.paymentMethod || orderData?.payment_method || orderData?.raw?.payment_method || ''; if (method === 'razorpay') { // Surface a useful server error only after the automatic retries have

High

Ai Review Evidence

When useOrderPay mounts and receives order data, it calls startPayment automatically without waiting for a shopper click.

src/useOrderPay.jsView on unpkg · L208

217// been exhausted; the shopper should not have to click Retry. await startPayment(orderData, razorpayReady); } else {

High

Ai Review Evidence

When useOrderPay mounts and receives order data, it calls startPayment automatically without waiting for a shopper click.

src/useOrderPay.jsView on unpkg · L217

169const result = await checkout.payOrder(resolvedOrderId, resolvedOrderKey, { billingAddress: orderData.billingAddress, shippingAddress: orderData.shippingAddress, paymentMethod: method, }); if (resu

High

Ai Review Evidence

The payment flow submits the order ID, order key, and payment method to checkout.orderPay.pay.

src/useOrderPay.jsView on unpkg · L169

src/checkout.jsView file

138return out; }, async getOrderPay(orderId, key, billingEmail = '') { return normalize(await dispatch('checkout.orderPay.get', { orderId, key, billingEmail })); }, async payOrder(orderId, key, data = {}) { return normalize(await dispatch('checkout.orderPay.pay', { orderId, key, ...data })); }, async getRazorpayPaymen

High

Ai Review Evidence

The payment flow submits the order ID, order key, and payment method to checkout.orderPay.pay.

src/checkout.jsView on unpkg · L138

src/client.jsView file

1const DEFAULT_CONFIG = { gatewayUrl: "/wp-json/elevell/v1/store", nonce: null, // Abort a request that the server never answers. Without this a stuck // ga

High

Ai Review Evidence

The SDK sends gateway requests to its configured endpoint, which defaults to the same-origin WordPress store route.

src/client.jsView on unpkg · L1

Findings

5 High1 Medium3 Low

HighAi Review Evidencesrc/useOrderPay.js

HighAi Review Evidencesrc/checkout.js

HighAi Review Evidencesrc/client.js

MediumNetwork

LowFilesystem

LowUrl Strings

LowNo License

Affected versions and remediation

This report applies to woo-elevell@0.92.0.

The versions list below shows the verdict for each recorded version.

Avoid installing woo-elevell@0.92.0. Remove it from direct dependencies and check your lockfile for transitive copies.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.
If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.

Evidence last updated: 2026-10-30 00:02:19.718Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

Versions

5 known versions

0.94.0latestUnknown—AllowUnder ReviewNov 4, 2026, 12:03 PM 0.93.0Suspicious—WarnPublishedOct 31, 2026, 9:01 AM 0.92.0shownMaliciousMalwareBlockPublishedOct 26, 2026, 6:41 PM 0.91.0Clean—AllowPublishedOct 26, 2026, 6:24 PM 0.8.0Clean—AllowPublishedOct 11, 2026, 11:13 AM

registry / Malware / woo-elevell

woo-elevell

This report shows the evidence for woo-elevell@0.92.0. 1 of 5 known versions is blocked or flagged. The newest version, 0.94.0, is allowed. See all versions.

AI Security Review

scanned 6d ago · by lpm-firewall-ai

Static reason

No blocking static signals were detected.

Trigger

A page using useOrderPay mounts with a valid order ID and order key.

Impact

A valid order payment may be initiated and funds charged without a separate shopper action on the payment page.

Mechanism

Attack narrative

AI rationale

Evidence

src/useOrderPay.jssrc/checkout.jssrc/client.js

Network endpoints2

/wp-json/elevell/v1/storecheckout.razorpay.com/v1/checkout.js

Decision evidence

public snapshot

AI called this Malicious at 91.0% confidence as Malware with low false-positive risk.

Evidence for block

When useOrderPay mounts and receives order data, it calls startPayment automatically without waiting for a shopper click.
The payment flow submits the order ID, order key, and payment method to checkout.orderPay.pay.
The SDK sends gateway requests to its configured endpoint, which defaults to the same-origin WordPress store route.

Evidence against

The package is a WooCommerce and React e-commerce SDK, so order payment support is part of its stated purpose.
Payment requests go through the configured store gateway; Razorpay’s checkout script is loaded from its official checkout host.

Behavioral surface

Source

FilesystemNetwork

Supply chain

UrlStrings

Manifest

NoLicense

scanned 44 file(s), 151 KB of source, external domains: checkout.razorpay.com

Source & flagged code

5 flagged

src/useOrderPay.jsView file

High

Ai Review Evidence

When useOrderPay mounts and receives order data, it calls startPayment automatically without waiting for a shopper click.

src/useOrderPay.jsView on unpkg · L208

217// been exhausted; the shopper should not have to click Retry. await startPayment(orderData, razorpayReady); } else {

High

Ai Review Evidence

When useOrderPay mounts and receives order data, it calls startPayment automatically without waiting for a shopper click.

src/useOrderPay.jsView on unpkg · L217

High

Ai Review Evidence

The payment flow submits the order ID, order key, and payment method to checkout.orderPay.pay.

src/useOrderPay.jsView on unpkg · L169

src/checkout.jsView file

High

Ai Review Evidence

The payment flow submits the order ID, order key, and payment method to checkout.orderPay.pay.

src/checkout.jsView on unpkg · L138

src/client.jsView file

1const DEFAULT_CONFIG = { gatewayUrl: "/wp-json/elevell/v1/store", nonce: null, // Abort a request that the server never answers. Without this a stuck // ga

High

Ai Review Evidence

The SDK sends gateway requests to its configured endpoint, which defaults to the same-origin WordPress store route.

src/client.jsView on unpkg · L1

Findings

5 High1 Medium3 Low

HighAi Review Evidencesrc/useOrderPay.js

HighAi Review Evidencesrc/checkout.js

HighAi Review Evidencesrc/client.js

MediumNetwork

LowFilesystem

LowUrl Strings

LowNo License

Affected versions and remediation

This report applies to woo-elevell@0.92.0.

The versions list below shows the verdict for each recorded version.

Avoid installing woo-elevell@0.92.0. Remove it from direct dependencies and check your lockfile for transitive copies.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.
If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.

Evidence last updated: 2026-10-30 00:02:19.718Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

Versions

5 known versions

AI Security Review

Decision evidence

Source & flagged code

Findings

Affected versions and remediation

Versions

AI Security Review

Decision evidence

Source & flagged code

Findings

Affected versions and remediation

Versions

Related packages

Other malware packages

Related packages

Other malware packages