root-cause-analysis

The diff removes the 30000 ms default and relies on PAYMENT_TIMEOUT_MS, which is absent from production; the failure pattern is consistent with a deployment/configuration regression, not malicious behavior. The change lacks fallback or startup validation, creating a significant reliability risk and causing checkout failures. The log’s undefined timer argument does not directly match Number(undefined), which yields NaN, so the compiled code and timeout implementation should be checked to explain the precise exception. No suspicious domains, URLs, IPs, credentials, or other indicators of malware are present in the supplied material.

The code has a high-confidence reliability flaw: a consumer failure after the order INSERT and before acknowledgment allows RabbitMQ redelivery to create a second order because processing is not idempotent and no uniqueness constraint is shown. The reported OOM and logs fit this failure path; the OOM cause is not established by the fragment. No malicious behavior, credential access, or suspicious network destination is present. Severity is moderate-to-high operational risk because it can cause duplicate orders and warehouse reservations; use an idempotency key or unique constraint and handle redelivery safely.

The change creates an unbounded in-process cache keyed by high-cardinality user and template inputs, retaining rendered HTML and causing memory growth consistent with the reported OOM crashes. This is a high-severity reliability and availability defect, with delayed notifications and duplicate digest emails reported as impacts. The fragment provides no evidence of data exfiltration, credential theft, or other malicious behavior; malware likelihood is low.