
Security News
Attackers Are Hunting High-Impact Node.js Maintainers in a Coordinated Social Engineering Campaign
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.
TypeScript SDK for ABA PayWay payment integration - Supports both client-side form submission and server-to-server API calls
An unofficial, type-safe TypeScript SDK for ABA PayWay payment integration. This SDK provides two integration patterns:
abapay)[!WARNING]
This is not a product of ABA Bank. This is an unofficial implementation based on https://www.payway.com.kh/developers/
This package is built upon and inspired by the excellent work of Seanghay Yath and the original payway-js package. We've extended it with:
Special thanks to the original contributors for laying the foundation!
date-fns for date formattingabapay with server-to-server)npm install payway-ts
abapay)Use this when the browser needs to submit directly to ABA PayWay.
// Server: Build signed payload
import { PayWayClient } from 'payway-ts';
const client = new PayWayClient(
process.env.PAYWAY_BASE_URL!,
process.env.PAYWAY_MERCHANT_ID!,
process.env.PAYWAY_API_KEY!
);
const payload = client.buildTransactionPayload({
amount: 100,
tran_id: 'ORDER-123',
payment_option: 'abapay',
return_url: 'https://yoursite.com/callback'
});
// Send payload to client
return Response.json(payload);
// Client: Create and submit form
const form = document.createElement('form');
form.method = payload.method;
form.action = payload.url;
for (const [key, value] of Object.entries(payload.fields)) {
const input = document.createElement('input');
input.type = 'hidden';
input.name = key;
input.value = String(value);
form.appendChild(input);
}
document.body.appendChild(form);
form.submit();
Use this when your server communicates directly with the ABA API.
import { PayWayClient } from 'payway-ts';
const client = new PayWayClient(
process.env.PAYWAY_BASE_URL!,
process.env.PAYWAY_MERCHANT_ID!,
process.env.PAYWAY_API_KEY!
);
// Create transaction
const result = await client.execute(
client.buildTransactionPayload({
amount: 100,
tran_id: 'ORDER-123',
payment_option: 'cards', // NOT 'abapay'
return_url: 'https://yoursite.com/callback'
})
);
// Check transaction status
const status = await client.execute(
client.buildCheckTransactionPayload('ORDER-123')
);
// List transactions
const transactions = await client.execute(
client.buildTransactionListPayload({
from_date: '20240101000000',
to_date: '20240131235959'
})
);
Comprehensive guides for every use case:
abapayCreate a .env.local file:
# Sandbox
PAYWAY_BASE_URL=https://checkout-sandbox.payway.com.kh/
PAYWAY_MERCHANT_ID=your_sandbox_merchant_id
PAYWAY_API_KEY=your_sandbox_api_key
# Production
# PAYWAY_BASE_URL=https://checkout.payway.com.kh/
# PAYWAY_MERCHANT_ID=your_production_merchant_id
# PAYWAY_API_KEY=your_production_api_key
# Optional: For pre-authorization
# ABA_RSA_PUBLIC_KEY=your_rsa_public_key
NEXT_PUBLIC_APP_URL=https://yoursite.com
All methods are fully typed:
import type {
PayWayClient,
CreateTransactionParams,
PayloadBuilderResponse,
TransactionStatus,
PaymentOption,
ExecuteOptions,
CompletePreAuthParams,
CompletePreAuthWithPayoutParams,
CancelPreAuthParams,
PreAuthResponse,
PayWayAPIError
} from 'payway-ts';
const params: CreateTransactionParams = {
amount: 100,
tran_id: 'ORDER-123',
currency: 'USD',
payment_option: 'abapay'
};
const payload: PayloadBuilderResponse = client.buildTransactionPayload(params);
npm test
npm run test:coverage
npm run build
npm run typecheck
MIT License - see LICENSE file for details
This is an unofficial SDK and is not affiliated with or endorsed by ABA Bank. Use at your own risk.
For ABA PayWay API documentation and support, please contact ABA Bank directly or visit https://www.payway.com.kh/developers/
tykealy
FAQs
A non-official TypeScript SDK for ABA PayWay
The npm package payway-ts receives a total of 92 weekly downloads. As such, payway-ts popularity was classified as not popular.
We found that payway-ts demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.

Security News
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.

Security News
Node.js has paused its bug bounty program after funding ended, removing payouts for vulnerability reports but keeping its security process unchanged.