registry / @workos/oagen-emitters / 0.19.10

@workos/oagen-emitters@0.19.10

WorkOS' oagen emitters

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 17 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 151 file(s), 3.26 MB of source, external domains: 127.0.0.1, api.workos.com, example.com

Source & flagged code

8 flagged

dist/plugin-ByzRxD5i.mjsView file

8880patternName = stripe_test_secret severity = high line = 8880 matchedText = lines.pu...;");

High

High Secret

Package contains a high-severity secret pattern.

dist/plugin-ByzRxD5i.mjsView on unpkg · L8880

8880patternName = stripe_test_secret severity = high line = 8880 matchedText = lines.pu...;");

High

Secret Pattern

Stripe test secret key in dist/plugin-ByzRxD5i.mjs

dist/plugin-ByzRxD5i.mjsView on unpkg · L8880

smoke/sdk-php.tsView file

Lines 1-37typescript

1/**

2 * PHP SDK smoke test -- captures wire-level HTTP exchanges from the generated

Source & flagged code

8 flagged · loading source

dist/plugin-ByzRxD5i.mjsView file

8880patternName = stripe_test_secret severity = high line = 8880 matchedText = lines.pu...;");

High

High Secret

Package contains a high-severity secret pattern.

dist/plugin-ByzRxD5i.mjsView on unpkg · L8880

8880patternName = stripe_test_secret severity = high line = 8880 matchedText = lines.pu...;");

High

Secret Pattern

Stripe test secret key in dist/plugin-ByzRxD5i.mjs

dist/plugin-ByzRxD5i.mjsView on unpkg · L8880

smoke/sdk-php.tsView file

17import { resolve, join } from 'node:path'; L18: import { execSync, spawn } from 'node:child_process'; L19: import { createServer, type IncomingMessage, type ServerResponse } from 'node:http';

High

Child Process

Package source references child process execution.

smoke/sdk-php.tsView on unpkg · L17

smoke/sdk-node.tsView file

255const sdkEntryPoint = resolve(sdkPath, 'src/index.ts'); L256: const sdkModule = await import(sdkEntryPoint); L257: const WorkOS = sdkModule.WorkOS || sdkModule.default?.WorkOS;

Medium

Dynamic Require

Package source references dynamic require/import behavior.

smoke/sdk-node.tsView on unpkg · L255

smoke/sdk-ruby.tsView file

491await new Promise<void>((resolvePromise, rejectPromise) => { L492: const child = spawn('ruby', [scriptPath], { L493: env: { L494: ...process.env, L495: WORKOS_API_KEY: apiKey, L496: WORKOS_BASE_URL: `http://127.0.0.1:${proxy.port}`, L497: },

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

smoke/sdk-ruby.tsView on unpkg · L491

docs/sdk-architecture/python.mdView file

433patternName = stripe_test_secret severity = high line = 433 matchedText = return W...uU")

High

Secret Pattern

Stripe test secret key in docs/sdk-architecture/python.md

docs/sdk-architecture/python.mdView on unpkg · L433

docs/sdk-architecture/node.mdView file

296patternName = stripe_test_secret severity = high line = 296 matchedText = const wo...U");

High

Secret Pattern

Stripe test secret key in docs/sdk-architecture/node.md

docs/sdk-architecture/node.mdView on unpkg · L296

src/node/tests.tsView file

332patternName = stripe_test_secret severity = high line = 332 matchedText = lines.pu...;");

High

Secret Pattern

Stripe test secret key in src/node/tests.ts

src/node/tests.tsView on unpkg · L332

Findings

8 High4 Medium5 Low

HighHigh Secretdist/plugin-ByzRxD5i.mjs

HighChild Processsmoke/sdk-php.ts

HighShell

HighSame File Env Network Executionsmoke/sdk-ruby.ts

HighSecret Patterndist/plugin-ByzRxD5i.mjs

HighSecret Patterndocs/sdk-architecture/python.md

HighSecret Patterndocs/sdk-architecture/node.md

HighSecret Patternsrc/node/tests.ts

MediumDynamic Requiresmoke/sdk-node.ts

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

smoke/sdk-node.tsView file

Lines 235-275typescript

235 }

236

237 const apiKey = process.env.WORKOS_API_KEY || process.env.API_KEY;

238 if (!apiKey) {

239 console.error('API key required. Set WORKOS_API_KEY or API_KEY env var.');

240 process.exit(1);

241 }

242

243 // Load config

244 loadSmokeConfig(smokeConfig);

245

246 // Parse spec

247 console.log('Parsing spec...');

248 const spec = await parseSpec(specPath);

249 console.log(`Spec: ${spec.name} v${spec.version}`);

250

251 // Load manifest

252 const manifest = loadManifest(sdkPath);

253

254 // Import SDK dynamically from the sdk-path

255 const sdkEntryPoint = resolve(sdkPath, 'src/index.ts');

256 const sdkModule = await import(sdkEntryPoint);

257 const WorkOS = sdkModule.WorkOS || sdkModule.default?.WorkOS;

Medium

Dynamic Require

Package source references dynamic require/import behavior.

smoke/sdk-node.tsView on unpkg · L255

258

259 if (!WorkOS) {

260 console.error(`Could not find WorkOS class in ${sdkEntryPoint}`);

261 process.exit(1);

262 }

263

264 const baseUrl = process.env.WORKOS_BASE_URL || spec.baseUrl;

265 const client = new WorkOS({ apiKey, apiHostname: new URL(baseUrl).hostname });

266

267 // Plan operations

268 const groups = planOperations(spec);

269 const ids = new IdRegistry();

270 const exchanges: CapturedExchange[] = [];

271 const createdEntities: Array<{

272 service: string;

273 id: string;

274 deleteFn?: () => Promise<void>;

275 }> = [];

smoke/sdk-ruby.tsView file

Lines 471-511typescript

471 const scriptPath = join(tmpDir, `smoke_wave_${waveNumber}.rb`);

472 writeFileSync(scriptPath, rubyScript);

473

474 // Execute the batched script

475 const callResults = new Map<

476 number,

477 {

478 captureIndexBefore: number;

479 captureIndexAfter: number;

480 error?: string;

481 startTime: number;

482 endTime: number;

483 }

484 >();

485

486 let currentCallIndex = -1;

487 let currentCallStart = Date.now();

488 let currentCapturesBefore = 0;

489

490 try {

491 await new Promise<void>((resolvePromise, rejectPromise) => {

492 const child = spawn('ruby', [scriptPath], {

493 env: {

494 ...process.env,

495 WORKOS_API_KEY: apiKey,

496 WORKOS_BASE_URL: `http://127.0.0.1:${proxy.port}`,

497 },

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

smoke/sdk-ruby.tsView on unpkg · L491

498 stdio: ['pipe', 'pipe', 'pipe'],

499 });

500

501 const timeout = setTimeout(() => {

502 child.kill('SIGKILL');

503 rejectPromise(new Error('Batch Ruby script timed out after 300s'));

504 }, 300_000);

505

506 let stderrBuf = '';

507

508 child.stderr.on('data', (data: Buffer) => {

509 stderrBuf += data.toString();

510 const lines = stderrBuf.split('\n');

511 stderrBuf = lines.pop() || '';

docs/sdk-architecture/python.mdView file

Lines 413-453markdown

413- `MAX_RETRY_DELAY = 8.0` (seconds)

414- `RETRY_MULTIPLIER = 2.0`

415- Retryable statuses: `429, 500, 502, 503, 504`

416- Backoff: `min(INITIAL_RETRY_DELAY * RETRY_MULTIPLIER ** attempt, MAX_RETRY_DELAY)`

417- Jitter: `delay * (0.5 + random())`

418- Respect `Retry-After` header for 429

419- Auto-generated UUID idempotency keys for POST, reused across retries

420

421## Testing Pattern

422

423Framework: pytest + pytest-httpx

424

425```python

426import pytest

427from workos import WorkOS

428from workos.organizations.models import Organization

429

430

431@pytest.fixture

432def workos():

433 return WorkOS(api_key="sk_test_Sz3IQjepeSWaI4cMS4ms4sMuU")

High

Secret Pattern

Stripe test secret key in docs/sdk-architecture/python.md

docs/sdk-architecture/python.mdView on unpkg · L433

434

435

436class TestOrganizations:

437 def test_list_organizations(self, workos, httpx_mock):

438 httpx_mock.add_response(

439 url="https://api.workos.com/organizations",

440 json=load_fixture("list_organizations.json"),

441 )

442 page = workos.organizations.list_organizations()

443 assert len(page.data) == 7

444 assert isinstance(page.data[0], Organization)

445

446 def test_get_organization(self, workos, httpx_mock):

447 httpx_mock.add_response(

448 url="https://api.workos.com/organizations/org_01234",

449 json=load_fixture("organization.json"),

450 )

451 org = workos.organizations.get_organization("org_01234")

452 assert org.id == "org_01234"

453 assert isinstance(org, Organization)

docs/sdk-architecture/node.mdView file

Lines 276-316markdown

276- `MINIMUM_SLEEP_TIME_IN_MILLISECONDS = 500`

277- `RETRY_STATUS_CODES = [408, 500, 502, 504]`

278- Path-specific retry: only for `/fga/`, `/vault/`, `/audit_logs/events`

279- Jitter: `sleepTime * (Math.random() + 0.5)`

280

281## Testing Pattern

282

283Framework: Jest + `jest-fetch-mock`

284

285From `src/organizations/organizations.spec.ts`:

286

287```typescript

288import fetch from "jest-fetch-mock";

289import {

290 fetchOnce,

291 fetchURL,

292 fetchSearchParams,

293 fetchBody,

294} from "../common/utils/test-utils";

295

296const workos = new WorkOS("sk_test_Sz3IQjepeSWaI4cMS4ms4sMuU");

High

Secret Pattern

Stripe test secret key in docs/sdk-architecture/node.md

docs/sdk-architecture/node.mdView on unpkg · L296

297

298describe("Organizations", () => {

299 beforeEach(() => fetch.resetMocks());

300

301 it("returns organizations and metadata", async () => {

302 fetchOnce(listOrganizationsFixture);

303 const { data, listMetadata } =

304 await workos.organizations.listOrganizations();

305 expect(fetchSearchParams()).toEqual({ order: "desc" });

306 expect(data).toHaveLength(7);

307 });

308});

309```

310

311Test utilities: `fetchOnce`, `fetchURL`, `fetchSearchParams`, `fetchHeaders`, `fetchBody`.

312

313## Directory Structure

314

315```

316src/

src/node/tests.tsView file

Lines 312-352typescript

312 fixtureImports.add(`import list${itemModelName}Fixture from '${fixturePath}';`);

313 }

314 } else if (plan.responseModelName) {

315 const respService = modelToService.get(plan.responseModelName);

316 const respDir = resolveDir(respService);

317 const fixturePath =

318 respDir === serviceDir

319 ? `./fixtures/${fileName(plan.responseModelName)}.json`

320 : `../${respDir}/fixtures/${fileName(plan.responseModelName)}.json`;

321 fixtureImports.add(`import ${toCamelCase(plan.responseModelName)}Fixture from '${fixturePath}';`);

322 }

323 // NOTE: Request body fixtures are not imported for body tests because

324 // fixtures use wire format (snake_case) but methods expect domain types

325 // (camelCase). Body tests use `{} as any` instead.

326 }

327 for (const imp of fixtureImports) {

328 lines.push(imp);

329 }

330

331 lines.push('');

332 lines.push("const workos = new WorkOS('sk_test_Sz3IQjepeSWaI4cMS4ms4sMuU');");

High

Secret Pattern

Stripe test secret key in src/node/tests.ts

src/node/tests.tsView on unpkg · L332

333 lines.push('');

334

335 // Generate per-entity assertion helpers for models used in 2+ tests.

336 // This deduplicates the field assertion blocks that would otherwise be

337 // copy-pasted across list/find/create/update test cases. Count across

338 // `allPlans` (incl. hand-owned methods) so a helper a preserved hand test

339 // block needs survives, but only emit one that an emitted `describe` or a

340 // preserved `@oagen-ignore` block actually references — otherwise it would

341 // be an unused function.

342 const ignoreRegionText = existingTestIgnoreText(ctx, testPath);

343 const { lines: helperLines, helpers: entityHelperNames } = generateEntityHelpers(

344 service,

345 allPlans,

346 plans,

347 ignoreRegionText,

348 modelMap,

349 ctx,

350 );

351 for (const line of helperLines) {

352 lines.push(line);