registry / @workos/emulate / 0.2.1

@workos/emulate@0.2.1

Local WorkOS API emulator for tests and development

AI Security Review

scanned 2h ago · by lpm-firewall-ai

No confirmed malicious attack surface. The emulator starts only through explicit CLI/import use and sends event POSTs only to caller-configured webhook endpoints.

Static reason

One or more suspicious static signals were detected.

Trigger

User runs `workos-emulate` or calls `createEmulator`, then configures webhook endpoints.

Impact

No unconsented exfiltration, persistence, destructive action, or remote payload execution established.

Mechanism

Local development HTTP emulator with configured webhook delivery.

Rationale

The flagged network behavior is the documented, user-configured webhook feature of a local WorkOS emulator. The `prepare` Husky entry is a development hook reference, with no packaged hook directory or malicious install-time behavior found.

Evidence

package.jsondist/cli.jsdist/index.jsdist/core/server.jsdist/workos/event-bus.jsdist/workos/routes/webhook-endpoints.jsdist/core/middleware/auth.jsdist/workos/config-validator.jsdist/workos/helpers.jsREADME.md

Decision evidence

public snapshot

AI called this Clean at 94.0% confidence as Benign with low false-positive risk.

Evidence for block

`package.json` declares `prepare: husky`.
`dist/workos/event-bus.js` POSTs events to configured webhook URLs.

Evidence against

`dist/cli.js` only reads user-selected or local seed config files.
No child-process, eval/vm, dynamic loading, credential harvesting, or file-writing APIs appear in `dist`.
Webhook URLs are supplied through seed data or the authenticated `/webhook_endpoints` API in `dist/workos/routes/webhook-endpoints.js`.
`dist/core/server.js` uses in-memory state; package root contains no `.husky` directory or payload files.

Behavioral surface

Source

CryptoFilesystemNetwork

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 60 file(s), 278 KB of source, external domains: api.workos.com, emulator.workos.test

Source & flagged code

1 flagged

dist/workos/helpers.jsView file

Lines 85-125javascript

85 * default to — a fixed provider would just be a fabricated guess.

86 * - 'MFA' and 'EmailVerification' are verification gates, not methods. The real method is

87 * whatever initiated the flow; callers pass it via the primary method when known (an MFA

88 * challenge records the primary factor on the pending-auth token). When it isn't known, the

89 * field is omitted rather than guessed.

90 * Everything already spec-valid (Password, MagicAuth, SSO, Passkey, GoogleOAuth, …) passes through.

91 */

92export function resolveResponseAuthMethod(method, opts) {

93 switch (method) {

94 case 'OAuth':

95 return opts?.oauthProvider ?? undefined;

96 case 'MFA':

97 case 'EmailVerification':

98 return undefined;

99 default:

100 return method;

101 }

102}

103/** Maps a session `auth_method` (snake_case) back to a spec-valid response authentication_method. */

104const SESSION_AUTH_METHOD_RESPONSE_VALUES = {

105 password: 'Password',

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/workos/helpers.jsView on unpkg · L105

106 magic_code: 'MagicAuth',

107 sso: 'SSO',

108 passkey: 'Passkey',

109 cross_app_auth: 'CrossAppAuth',

110 external_auth: 'ExternalAuth',

111 impersonation: 'Impersonation',

112 migrated_session: 'MigratedSession',

113};

114/**

115 * Resolve the response authentication_method for a refresh_token grant, which reuses an existing

116 * session rather than authenticating fresh. Real WorkOS echoes the session's *original* method, so

117 * we recover it from the reused session's stored `auth_method` (snake_case) instead of the grant's

118 * hard-coded 'OAuth' category — a password login that refreshes truthfully reports 'Password'.

119 *

120 * Generic 'oauth' has no provider recorded on the session, so it falls back to the user's

121 * oauth_provider (else omitted); 'unknown' and any unmapped value are omitted rather than guessed.

122 */

123export function resolveSessionResponseAuthMethod(sessionAuthMethod, opts) {

124 if (sessionAuthMethod === 'oauth')

125 return opts?.oauthProvider ?? undefined;

Source & flagged code

1 flagged · loading source

dist/workos/helpers.jsView file

105patternName = generic_password severity = medium line = 105 matchedText = password...rd',

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/workos/helpers.jsView on unpkg · L105

Findings

2 Medium5 Low

MediumSecret Patterndist/workos/helpers.js

MediumNetwork

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

1 flagged

dist/workos/helpers.jsView file

Lines 85-125javascript

85 * default to — a fixed provider would just be a fabricated guess.

86 * - 'MFA' and 'EmailVerification' are verification gates, not methods. The real method is

87 * whatever initiated the flow; callers pass it via the primary method when known (an MFA

88 * challenge records the primary factor on the pending-auth token). When it isn't known, the

89 * field is omitted rather than guessed.

90 * Everything already spec-valid (Password, MagicAuth, SSO, Passkey, GoogleOAuth, …) passes through.

91 */

92export function resolveResponseAuthMethod(method, opts) {

93 switch (method) {

94 case 'OAuth':

95 return opts?.oauthProvider ?? undefined;

96 case 'MFA':

97 case 'EmailVerification':

98 return undefined;

99 default:

100 return method;

101 }

102}

103/** Maps a session `auth_method` (snake_case) back to a spec-valid response authentication_method. */

104const SESSION_AUTH_METHOD_RESPONSE_VALUES = {

105 password: 'Password',

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/workos/helpers.jsView on unpkg · L105

106 magic_code: 'MagicAuth',

107 sso: 'SSO',

108 passkey: 'Passkey',

109 cross_app_auth: 'CrossAppAuth',

110 external_auth: 'ExternalAuth',

111 impersonation: 'Impersonation',

112 migrated_session: 'MigratedSession',

113};

114/**

115 * Resolve the response authentication_method for a refresh_token grant, which reuses an existing

116 * session rather than authenticating fresh. Real WorkOS echoes the session's *original* method, so

117 * we recover it from the reused session's stored `auth_method` (snake_case) instead of the grant's

118 * hard-coded 'OAuth' category — a password login that refreshes truthfully reports 'Password'.

119 *

120 * Generic 'oauth' has no provider recorded on the session, so it falls back to the user's

121 * oauth_provider (else omitted); 'unknown' and any unmapped value are omitted rather than guessed.

122 */

123export function resolveSessionResponseAuthMethod(sessionAuthMethod, opts) {

124 if (sessionAuthMethod === 'oauth')

125 return opts?.oauthProvider ?? undefined;