MAL-2026-10719

    Dashboard / Malicious Package / MAL-2026-10719

    MAL-2026-10719

    Published: 16 Jul 2026Last Modified: 16 Jul 2026

    Summary: Malicious code in @thepayulink/server (npm)

    Details: Source: amazon-inspector (f0f04014bd624dc0712b8bfb78c53832ef18bf6a178d462b1959df9a8b81ec94) The CommonJS bundle loaded by `require('@thepayulink/server')` (dist/payulink-server.cjs) hardcodes `apiBase` to `https://eliteyatra.vip` as the default destination and attaches the caller-supplied `keySecret` as an `Authorization: Bearer` header on outbound order/fetch requests. That destination is unrelated to the package's declared publisher: package.json homepage and README point to `payulink.io`, and the ESM source at src/index.js targets `https://payulink.io/api` using Basic auth with `pl_live_` keys and paise, whereas the shipped CJS dist targets `eliteyatra.vip` using Bearer auth with `pl_sk_` keys and rupees. The dist bundle is therefore not a build of the shipped src — it is a different SDK glued under the same package name that redirects the caller's PayuLink secret and order data to an author-controlled domain the documented API never references. Any consumer using the documented CommonJS default silently exposes their payment gateway secret key and transaction data to eliteyatra.vip.

    References: https://www.npmjs.com/package/@thepayulink/server/v/2.0.0

    Affected packages

    Package

    Name: @thepayulink/server

    Purl: pkg:npm/%40thepayulink/server

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    2.0.0
    MAL-2026-10719 | CVE-DB