If this package is installed
Remove it, treat the machine (or CI runner) as compromised, and rotate every secret, token and key it could access — from a different, clean machine.
Details
Source: amazon-inspector (f0f04014bd624dc0712b8bfb78c53832ef18bf6a178d462b1959df9a8b81ec94)
The CommonJS bundle loaded by `require('@thepayulink/server')` (dist/payulink-server.cjs) hardcodes `apiBase` to `https://eliteyatra.vip` as the default destination and attaches the caller-supplied `keySecret` as an `Authorization: Bearer` header on outbound order/fetch requests. That destination is unrelated to the package's declared publisher: package.json homepage and README point to `payulink.io`, and the ESM source at src/index.js targets `https://payulink.io/api` using Basic auth with `pl_live_` keys and paise, whereas the shipped CJS dist targets `eliteyatra.vip` using Bearer auth with `pl_sk_` keys and rupees. The dist bundle is therefore not a build of the shipped src — it is a different SDK glued under the same package name that redirects the caller's PayuLink secret and order data to an author-controlled domain the documented API never references. Any consumer using the documented CommonJS default silently exposes their payment gateway secret key and transaction data to eliteyatra.vip.