MAL-2026-10719

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@thepayulink/server/MAL-2026-10719.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-10719
Published
2026-07-16T18:45:45Z
Modified
2026-07-16T19:19:38.087505209Z
Summary
Malicious code in @thepayulink/server (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (f0f04014bd624dc0712b8bfb78c53832ef18bf6a178d462b1959df9a8b81ec94)

The CommonJS bundle loaded by require('@thepayulink/server') (dist/payulink-server.cjs) hardcodes apiBase to https://eliteyatra.vip as the default destination and attaches the caller-supplied keySecret as an Authorization: Bearer header on outbound order/fetch requests. That destination is unrelated to the package's declared publisher: package.json homepage and README point to payulink.io, and the ESM source at src/index.js targets https://payulink.io/api using Basic auth with pl_live_ keys and paise, whereas the shipped CJS dist targets eliteyatra.vip using Bearer auth with pl_sk_ keys and rupees. The dist bundle is therefore not a build of the shipped src — it is a different SDK glued under the same package name that redirects the caller's PayuLink secret and order data to an author-controlled domain the documented API never references. Any consumer using the documented CommonJS default silently exposes their payment gateway secret key and transaction data to eliteyatra.vip.

Database specific 
{
    "malicious-packages-origins": [
        {
            "import_time": "2026-07-16T18:54:04.060583826Z",
            "modified_time": "2026-07-16T18:45:45Z",
            "sha256": "f0f04014bd624dc0712b8bfb78c53832ef18bf6a178d462b1959df9a8b81ec94",
            "versions": [
                "2.0.0"
            ],
            "id": "IN-MAL-2026-010774",
            "source": "amazon-inspector"
        }
    ]
}
References
Credits

Affected packages

npm / @thepayulink/server

Package

Name
@thepayulink/server
View open source insights on deps.dev
Purl
pkg:npm/%40thepayulink/server

Affected ranges

Affected versions

2.*
2.0.0

Database specific

indicators 
{
    "evidence_files": [
        {
            "tlsh": "9fe1820b31f2903389a290a77b278916ef65555664c98864b6dc82fc2fcd570cae8fe1",
            "sha256": "7afbd49ce02714be62eea2785d0f1c1a8e9561b14ac934f25004e326b50caeae",
            "path": "dist/payulink-server.cjs"
        }
    ],
    "package_integrity": [
        {
            "filename": "server-2.0.0.tgz",
            "hashes": {
                "sha1": "671a99d9a901d3198543baa0673ba97098301de8",
                "sha512_sri": "sha512-io+WcufgaqnGrm5T3V1eA8A9/mfLl4DdBrxnZfl7piiuC73Pey/cWm7f7oVhb6ABHazui5p2Fb4hdRxFuUNIzg=="
            }
        }
    ]
}
cwes 
[
    {
        "cweId": "CWE-506",
        "name": "Embedded Malicious Code",
        "description": "The product contains code that appears to be malicious in nature."
    }
]
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@thepayulink/server/MAL-2026-10719.json"