registry / Malware / woo-elevell / 0.92.0

woo-elevell@0.92.0

The **woo-elevell SDK** is a headless e-commerce integration framework for React and WordPress/WooCommerce. It bridges server-rendered WooCommerce environments with dynamic React frontends, providing server-side runtime hydration via `window.__ELEVELL__`,

AI Security Review

scanned 6d ago · by lpm-firewall-ai

The order payment hook initiates payment automatically on page mount, without requiring a shopper click. Because this can cause a valid order to be charged without a distinct payment action, it meets the automatic-spending rule.

Static reason

No blocking static signals were detected.

Trigger

A page using useOrderPay mounts with a valid order ID and order key.

Impact

A valid order payment may be initiated and funds charged without a separate shopper action on the payment page.

Mechanism

The hook fetches order details and calls the payment flow without a user click. That flow submits the order credentials and payment method to the store gateway; Razorpay orders also open the payment checkout automatically.

Attack narrative

When an order-pay page using useOrderPay mounts, the hook fetches the order and automatically starts payment with its order ID, key, and payment method. The payment request is sent through the store gateway, and Razorpay checkout is opened automatically for Razorpay orders.

AI rationale

Evidence

src/useOrderPay.jssrc/checkout.jssrc/client.js

Network endpoints2

/wp-json/elevell/v1/storecheckout.razorpay.com/v1/checkout.js

Decision evidence

public snapshot

AI called this Malicious at 91.0% confidence as Malware with low false-positive risk.

Evidence for block

When useOrderPay mounts and receives order data, it calls startPayment automatically without waiting for a shopper click.
The payment flow submits the order ID, order key, and payment method to checkout.orderPay.pay.
The SDK sends gateway requests to its configured endpoint, which defaults to the same-origin WordPress store route.

Evidence against

The package is a WooCommerce and React e-commerce SDK, so order payment support is part of its stated purpose.
Payment requests go through the configured store gateway; Razorpay’s checkout script is loaded from its official checkout host.

Behavioral surface

Source

FilesystemNetwork

Supply chain

UrlStrings

Manifest

NoLicense

scanned 44 file(s), 151 KB of source, external domains: checkout.razorpay.com

Source & flagged code

5 flagged

src/useOrderPay.jsView file

208const razorpayReady = loadRazorpay(); checkout.getOrderPay(resolvedOrderId, resolvedOrderKey) .then(async (orderData) => { if (!active) return; setOrder(orderData); const method = orderData?.paymentMethod || orderData?.payment_method || orderData?.raw?.payment_method || ''; if (method === 'razorpay') { // Surface a useful server error only after the automatic retries have

High

Ai Review Evidence

When useOrderPay mounts and receives order data, it calls startPayment automatically without waiting for a shopper click.

src/useOrderPay.jsView on unpkg · L208

217// been exhausted; the shopper should not have to click Retry. await startPayment(orderData, razorpayReady); } else {

High

Ai Review Evidence

When useOrderPay mounts and receives order data, it calls startPayment automatically without waiting for a shopper click.

src/useOrderPay.jsView on unpkg · L217

169const result = await checkout.payOrder(resolvedOrderId, resolvedOrderKey, { billingAddress: orderData.billingAddress, shippingAddress: orderData.shippingAddress, paymentMethod: method, }); if (resu

Findings

5 High1 Medium3 Low

HighAi Review Evidencesrc/useOrderPay.js

HighAi Review Evidencesrc/checkout.js

HighAi Review Evidencesrc/client.js

MediumNetwork

LowFilesystem

LowUrl Strings

LowNo License

Affected versions and remediation

This report applies to woo-elevell@0.92.0.

See all versions of woo-elevell for other recorded verdicts.

Avoid installing woo-elevell@0.92.0. Remove it from direct dependencies and check your lockfile for transitive copies.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.
If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.

Evidence last updated: 2026-10-30 00:02:19.718Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

registry / Malware / woo-elevell / 0.92.0

woo-elevell@0.92.0

AI Security Review

scanned 6d ago · by lpm-firewall-ai

Static reason

No blocking static signals were detected.

Trigger

A page using useOrderPay mounts with a valid order ID and order key.

Impact

A valid order payment may be initiated and funds charged without a separate shopper action on the payment page.

Mechanism

Attack narrative

AI rationale

Evidence

src/useOrderPay.jssrc/checkout.jssrc/client.js

Network endpoints2

/wp-json/elevell/v1/storecheckout.razorpay.com/v1/checkout.js

Decision evidence

public snapshot

AI called this Malicious at 91.0% confidence as Malware with low false-positive risk.

Evidence for block

When useOrderPay mounts and receives order data, it calls startPayment automatically without waiting for a shopper click.
The payment flow submits the order ID, order key, and payment method to checkout.orderPay.pay.
The SDK sends gateway requests to its configured endpoint, which defaults to the same-origin WordPress store route.

Evidence against

The package is a WooCommerce and React e-commerce SDK, so order payment support is part of its stated purpose.
Payment requests go through the configured store gateway; Razorpay’s checkout script is loaded from its official checkout host.

Behavioral surface

Source

FilesystemNetwork

Supply chain

UrlStrings

Manifest

NoLicense

scanned 44 file(s), 151 KB of source, external domains: checkout.razorpay.com

Source & flagged code

5 flagged

src/useOrderPay.jsView file

High

Ai Review Evidence

When useOrderPay mounts and receives order data, it calls startPayment automatically without waiting for a shopper click.

src/useOrderPay.jsView on unpkg · L208

217// been exhausted; the shopper should not have to click Retry. await startPayment(orderData, razorpayReady); } else {

High

Ai Review Evidence

When useOrderPay mounts and receives order data, it calls startPayment automatically without waiting for a shopper click.

src/useOrderPay.jsView on unpkg · L217

Findings

5 High1 Medium3 Low

HighAi Review Evidencesrc/useOrderPay.js

HighAi Review Evidencesrc/checkout.js

HighAi Review Evidencesrc/client.js

MediumNetwork

LowFilesystem

LowUrl Strings

LowNo License

Affected versions and remediation

This report applies to woo-elevell@0.92.0.

See all versions of woo-elevell for other recorded verdicts.

Avoid installing woo-elevell@0.92.0. Remove it from direct dependencies and check your lockfile for transitive copies.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.
If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.

Evidence last updated: 2026-10-30 00:02:19.718Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

AI Security Review

Decision evidence

Source & flagged code

Findings

Affected versions and remediation

AI Security Review

Decision evidence

Source & flagged code

Findings

Affected versions and remediation

Related packages

Other malware packages

Related packages

Other malware packages