🌀 OpenAPI to TypeScript code generator. Production-grade SDKs, Zod schemas, TanStack Query hooks, and 20+ plugins. Used by Vercel, OpenCode, and PayPal.
78%
Total Score
75
90
67
100
One contributor made about 82% of the recent commits, which is concentrated, but the organization-owned project has five other active contributors who provide some handoff capacity.
The repository is actively receiving reports and pull requests, but 59 new issues versus 4 closed and only 2 merged pull requests in the last month indicate a growing backlog.
The repository uses TypeScript, Vitest, Turbo, and npm scripts, but no security scanning tools were detected, leaving a modest security-process gap.
No security policy was found in the repository, reducing transparency for vulnerability reporting and response.
Version 0.99.0 is not a prerelease, but every recent release is still below a stable major version, so API stability may be less predictable.
| Title | Versions | Severity |
|---|---|---|
CVE-2026-48819 @hey-api/openapi-ts is vulnerable to Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') in versions 0.0.0 - 0.97.3. | 0.0.0 - 0.97.3 | Medium |
| Dependency | Last Release | Score |
|---|---|---|
commander Version 15.0.0 | — | — |
@lukeed/ms Version 2.0.2 | — | — |
ansi-colors Version 4.1.3 | — | — |
get-tsconfig Version 4.14.0 | — | — |
color-support Version 1.1.3 | — | — |
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.

I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant
ISO 42001Compliant© All Intel data is openly available and commercially licensed.