registry / @workos/oagen-emitters / 0.19.7

@workos/oagen-emitters@0.19.7

WorkOS' oagen emitters

Static Scan Results

scanned 15d ago · by rust-scanner

Static analysis flagged 17 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 151 file(s), 3.25 MB of source, external domains: 127.0.0.1, api.workos.com, example.com

Source & flagged code

8 flagged

dist/plugin-7Wb4_99Q.mjsView file

8854patternName = stripe_test_secret severity = high line = 8854 matchedText = lines.pu...;");

High

High Secret

Package contains a high-severity secret pattern.

dist/plugin-7Wb4_99Q.mjsView on unpkg · L8854

8854patternName = stripe_test_secret severity = high line = 8854 matchedText = lines.pu...;");

High

Secret Pattern

Stripe test secret key in dist/plugin-7Wb4_99Q.mjs

dist/plugin-7Wb4_99Q.mjsView on unpkg · L8854

smoke/sdk-php.tsView file

Lines 1-37typescript

1/**

2 * PHP SDK smoke test -- captures wire-level HTTP exchanges from the generated

3 * WorkOS PHP SDK via a local HTTP proxy and outputs SmokeResults JSON for diff

4 * comparison.

5 *

6 * Uses a batched approach: generates ONE PHP script that calls ALL operations

7 * sequentially, eliminating per-operation cold start overhead. Uses `spawn`

8 * (async) so the proxy event loop can process requests concurrently.

9 *

10 * Usage:

11 * npx tsx smoke/sdk-php.ts --spec ../openapi-spec/spec/open-api-spec.yaml --sdk-path ./sdk

12 *

13 * Requires API_KEY or WORKOS_API_KEY env var and `php` on $PATH.

14 */

16import { readFileSync, writeFileSync, existsSync, mkdirSync } from 'node:fs';

17import { resolve, join } from 'node:path';

18import { execSync, spawn } from 'node:child_process';

19import { createServer, type IncomingMessage, type ServerResponse } from 'node:http';

High

Child Process

Package source references child process execution.

smoke/sdk-php.tsView on unpkg · L17

20import {

21 parseSpec,

22 planOperations,

23 planWaves,

24 generatePayload,

25 generateQueryParams,

26 IdRegistry,

27 delay,

28 parseCliArgs,

29 loadSmokeConfig,

30 getExpectedStatusCodes,

31 isUnexpectedStatus,

32 toCamelCase,

33 SERVICE_PROPERTY_MAP,

34} from '@workos/oagen/smoke';

35import type { CapturedExchange, SmokeResults, ExchangeProvenance, OperationWave } from '@workos/oagen/smoke';

36import type { Operation } from '@workos/oagen';

smoke/sdk-node.tsView file

Lines 235-275typescript

235 }

236

237 const apiKey = process.env.WORKOS_API_KEY || process.env.API_KEY;

238 if (!apiKey) {

239 console.error('API key required. Set WORKOS_API_KEY or API_KEY env var.');

240 process.exit(1);

smoke/sdk-ruby.tsView file

Lines 471-511typescript

471 const scriptPath = join(tmpDir, `smoke_wave_${waveNumber}.rb`);

472 writeFileSync(scriptPath, rubyScript);

473

474 // Execute the batched script

475 const callResults = new Map<

476 number,

docs/sdk-architecture/python.mdView file

Lines 413-453markdown

413- `MAX_RETRY_DELAY = 8.0` (seconds)

414- `RETRY_MULTIPLIER = 2.0`

415- Retryable statuses: `429, 500, 502, 503, 504`

416- Backoff: `min(INITIAL_RETRY_DELAY * RETRY_MULTIPLIER ** attempt, MAX_RETRY_DELAY)`

417- Jitter: `delay * (0.5 + random())`

418- Respect `Retry-After` header for 429

419- Auto-generated UUID idempotency keys for POST, reused across retries

docs/sdk-architecture/node.mdView file

Lines 276-316markdown

276- `MINIMUM_SLEEP_TIME_IN_MILLISECONDS = 500`

277- `RETRY_STATUS_CODES = [408, 500, 502, 504]`

278- Path-specific retry: only for `/fga/`, `/vault/`, `/audit_logs/events`

279- Jitter: `sleepTime * (Math.random() + 0.5)`

280

281## Testing Pattern

282

283Framework: Jest + `jest-fetch-mock`

284

src/node/tests.tsView file

Lines 312-352typescript

312 fixtureImports.add(`import list${itemModelName}Fixture from '${fixturePath}';`);

313 }

314 } else if (plan.responseModelName) {

315 const respService = modelToService.get(plan.responseModelName);

316 const respDir =

Source & flagged code

8 flagged · loading source

dist/plugin-7Wb4_99Q.mjsView file

8854patternName = stripe_test_secret severity = high line = 8854 matchedText = lines.pu...;");

High

High Secret

Package contains a high-severity secret pattern.

dist/plugin-7Wb4_99Q.mjsView on unpkg · L8854

8854patternName = stripe_test_secret severity = high line = 8854 matchedText = lines.pu...;");

High

Secret Pattern

Stripe test secret key in dist/plugin-7Wb4_99Q.mjs

dist/plugin-7Wb4_99Q.mjsView on unpkg · L8854

smoke/sdk-php.tsView file

17import { resolve, join } from 'node:path'; L18: import { execSync, spawn } from 'node:child_process'; L19: import { createServer, type IncomingMessage, type ServerResponse } from 'node:http';

High

Child Process

Package source references child process execution.

smoke/sdk-php.tsView on unpkg · L17

smoke/sdk-node.tsView file

255const sdkEntryPoint = resolve(sdkPath, 'src/index.ts'); L256: const sdkModule = await import(sdkEntryPoint); L257: const WorkOS = sdkModule.WorkOS || sdkModule.default?.WorkOS;

Medium

Dynamic Require

Package source references dynamic require/import behavior.

smoke/sdk-node.tsView on unpkg · L255

smoke/sdk-ruby.tsView file

491await new Promise<void>((resolvePromise, rejectPromise) => { L492: const child = spawn('ruby', [scriptPath], { L493: env: { L494: ...process.env, L495: WORKOS_API_KEY: apiKey, L496: WORKOS_BASE_URL: `http://127.0.0.1:${proxy.port}`, L497: },

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

smoke/sdk-ruby.tsView on unpkg · L491

docs/sdk-architecture/python.mdView file

433patternName = stripe_test_secret severity = high line = 433 matchedText = return W...uU")

High

Secret Pattern

Stripe test secret key in docs/sdk-architecture/python.md

docs/sdk-architecture/python.mdView on unpkg · L433

docs/sdk-architecture/node.mdView file

296patternName = stripe_test_secret severity = high line = 296 matchedText = const wo...U");

High

Secret Pattern

Stripe test secret key in docs/sdk-architecture/node.md

docs/sdk-architecture/node.mdView on unpkg · L296

src/node/tests.tsView file

332patternName = stripe_test_secret severity = high line = 332 matchedText = lines.pu...;");

High

Secret Pattern

Stripe test secret key in src/node/tests.ts

src/node/tests.tsView on unpkg · L332

Findings

8 High4 Medium5 Low

HighHigh Secretdist/plugin-7Wb4_99Q.mjs

HighChild Processsmoke/sdk-php.ts

HighShell

HighSame File Env Network Executionsmoke/sdk-ruby.ts

HighSecret Patterndist/plugin-7Wb4_99Q.mjs

HighSecret Patterndocs/sdk-architecture/python.md

HighSecret Patterndocs/sdk-architecture/node.md

HighSecret Patternsrc/node/tests.ts

MediumDynamic Requiresmoke/sdk-node.ts

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

8 flagged

dist/plugin-7Wb4_99Q.mjsView file

8854patternName = stripe_test_secret severity = high line = 8854 matchedText = lines.pu...;");

High

High Secret

Package contains a high-severity secret pattern.

dist/plugin-7Wb4_99Q.mjsView on unpkg · L8854

8854patternName = stripe_test_secret severity = high line = 8854 matchedText = lines.pu...;");

High

Secret Pattern

Stripe test secret key in dist/plugin-7Wb4_99Q.mjs

dist/plugin-7Wb4_99Q.mjsView on unpkg · L8854

smoke/sdk-php.tsView file

Lines 1-37typescript

1/**

2 * PHP SDK smoke test -- captures wire-level HTTP exchanges from the generated

3 * WorkOS PHP SDK via a local HTTP proxy and outputs SmokeResults JSON for diff

4 * comparison.

5 *

6 * Uses a batched approach: generates ONE PHP script that calls ALL operations

7 * sequentially, eliminating per-operation cold start overhead. Uses `spawn`

8 * (async) so the proxy event loop can process requests concurrently.

9 *

10 * Usage:

11 * npx tsx smoke/sdk-php.ts --spec ../openapi-spec/spec/open-api-spec.yaml --sdk-path ./sdk

12 *

13 * Requires API_KEY or WORKOS_API_KEY env var and `php` on $PATH.

14 */

16import { readFileSync, writeFileSync, existsSync, mkdirSync } from 'node:fs';

17import { resolve, join } from 'node:path';

18import { execSync, spawn } from 'node:child_process';

19import { createServer, type IncomingMessage, type ServerResponse } from 'node:http';

High

Child Process

Package source references child process execution.

smoke/sdk-php.tsView on unpkg · L17

20import {

21 parseSpec,

22 planOperations,

23 planWaves,

24 generatePayload,

25 generateQueryParams,

26 IdRegistry,

27 delay,

28 parseCliArgs,

29 loadSmokeConfig,

30 getExpectedStatusCodes,

31 isUnexpectedStatus,

32 toCamelCase,

33 SERVICE_PROPERTY_MAP,

34} from '@workos/oagen/smoke';

35import type { CapturedExchange, SmokeResults, ExchangeProvenance, OperationWave } from '@workos/oagen/smoke';

36import type { Operation } from '@workos/oagen';

smoke/sdk-node.tsView file

Lines 235-275typescript

235 }

236

237 const apiKey = process.env.WORKOS_API_KEY || process.env.API_KEY;

238 if (!apiKey) {

239 console.error('API key required. Set WORKOS_API_KEY or API_KEY env var.');

240 process.exit(1);

smoke/sdk-ruby.tsView file

Lines 471-511typescript

471 const scriptPath = join(tmpDir, `smoke_wave_${waveNumber}.rb`);

472 writeFileSync(scriptPath, rubyScript);

473

474 // Execute the batched script

475 const callResults = new Map<

476 number,

docs/sdk-architecture/python.mdView file

Lines 413-453markdown

413- `MAX_RETRY_DELAY = 8.0` (seconds)

414- `RETRY_MULTIPLIER = 2.0`

415- Retryable statuses: `429, 500, 502, 503, 504`

416- Backoff: `min(INITIAL_RETRY_DELAY * RETRY_MULTIPLIER ** attempt, MAX_RETRY_DELAY)`

417- Jitter: `delay * (0.5 + random())`

418- Respect `Retry-After` header for 429

419- Auto-generated UUID idempotency keys for POST, reused across retries

docs/sdk-architecture/node.mdView file

Lines 276-316markdown

276- `MINIMUM_SLEEP_TIME_IN_MILLISECONDS = 500`

277- `RETRY_STATUS_CODES = [408, 500, 502, 504]`

278- Path-specific retry: only for `/fga/`, `/vault/`, `/audit_logs/events`

279- Jitter: `sleepTime * (Math.random() + 0.5)`

280

281## Testing Pattern

282

283Framework: Jest + `jest-fetch-mock`

284

src/node/tests.tsView file

Lines 312-352typescript

312 fixtureImports.add(`import list${itemModelName}Fixture from '${fixturePath}';`);

313 }

314 } else if (plan.responseModelName) {

315 const respService = modelToService.get(plan.responseModelName);

316 const respDir =