execSync uses template literal with unsanitized scriptName parameter, allowing arbitrary command execution. Attacker can inject shell metacharacters.

Direct use of eval() with user-supplied expression parameter allows arbitrary JavaScript code execution.

new Function() with user-supplied code parameter enables arbitrary code execution, similar to eval().

Process completed with exit code 1.

ApiClientError: Request timed out ❯ ApiClient.wrapError src/client/api.ts:233:16 ❯ ApiClient.createWorkspace src/client/api.ts:101:18 ❯ test/integration/client.test.ts:83:21 ⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯ Serialized Error: { status: +0, code: 'TIMEOUT' }