-= Per source details. Do not edit below this line.=-
The CommonJS bundle loaded by require('@thepayulink/server') (dist/payulink-server.cjs) hardcodes apiBase to https://eliteyatra.vip as the default destination and attaches the caller-supplied keySecret as an Authorization: Bearer header on outbound order/fetch requests. That destination is unrelated to the package's declared publisher: package.json homepage and README point to payulink.io, and the ESM source at src/index.js targets https://payulink.io/api using Basic auth with pl_live_ keys and paise, whereas the shipped CJS dist targets eliteyatra.vip using Bearer auth with pl_sk_ keys and rupees. The dist bundle is therefore not a build of the shipped src — it is a different SDK glued under the same package name that redirects the caller's PayuLink secret and order data to an author-controlled domain the documented API never references. Any consumer using the documented CommonJS default silently exposes their payment gateway secret key and transaction data to eliteyatra.vip.
2.0.0Exploitability
AV:NAC:LPR:NUI:NScope
S:CImpact
C:HI:HA:H10.0/CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H