
Security News
Axios Supply Chain Attack Reaches OpenAI macOS Signing Pipeline, Forces Certificate Rotation
OpenAI rotated macOS signing certificates after a malicious Axios package reached its CI pipeline in a broader software supply chain attack.
openai-oxide
Advanced tools
Native Node.js bindings for openai-oxide, built with napi-rs. Also available on crates.io (Rust) and PyPI (Python).
The package exposes the Rust client to Node.js with native streaming and WebSocket support, while keeping release artifacts out of git. Prebuilt binaries are published to npm for the supported targets listed below.
openai-oxide cratetext or response idpnpmopenai-oxide on Node?| Feature | openai-oxide | official openai SDK |
|---|---|---|
| WebSocket Responses | Persistent wss:// session, reuses TLS for every step | REST-only |
| Streaming parser | Zero-copy SSE parser + early function-call parse | HTTP/2 response buffering |
| Typed Rust core | Full Response struct, hedged requests, parallel fan-outs | Generic JS objects |
| Hot REST paths | createText, createStoredResponseId, createTextFollowup avoid JSON bridge | Always serializes Record<string, any> |
| Platform binaries | Prebuilt .node for darwin/linux/windows in npm | Pure JS package |
The official SDK is great for HTTP/REST but does not expose WebSocket streaming or Rust-level hedged/parallel tooling out of the box. If your workload issues quick successive tool calls, streams tokens, or runs inside a WebSocket session, the native bindings keep latency and contention lower while still letting you call the same OpenAI APIs.
x64arm64x64 GNUx64 muslarm64 GNUarm64 muslx64 MSVCnpm install openai-oxide
# or
pnpm add openai-oxide
# or
yarn add openai-oxide
From the repository for local development:
cd openai-oxide-node
pnpm install
pnpm build
pnpm test
Client reads credentials from the same environment variables as the Rust crate, for example OPENAI_API_KEY.
const { Client } = require('openai-oxide')
async function main() {
const client = new Client()
const response = await client.createResponse({
model: 'gpt-4o-mini',
input: 'Say hello to Node.js from Rust via napi-rs.'
})
console.log(response.output?.[0]?.content?.[0]?.text)
}
main().catch((error) => {
console.error(error)
process.exitCode = 1
})
Examples live in examples/:
examples/01_basic_request.jsexamples/02_streaming.jsexamples/03_websocket.jsexamples/bench_node.jsBenchmarks were run locally against the live OpenAI API with:
BENCH_ITERATIONS=5 pnpm bench
Setup:
gpt-5.45openai npm SDKopenai-oxide vs openai)openai-oxide wins 8/8 tests. Native napi-rs bindings vs official openai npm.
| Test | openai-oxide | openai | Winner |
|---|---|---|---|
| Plain text | 1075ms | 1311ms | OXIDE (+18%) |
| Structured output | 1370ms | 1765ms | OXIDE (+22%) |
| Function calling | 1725ms | 1832ms | OXIDE (+6%) |
| Multi-turn (2 reqs) | 2283ms | 2859ms | OXIDE (+20%) |
| Rapid-fire (5 calls) | 6246ms | 6936ms | OXIDE (+10%) |
| Streaming TTFT | 534ms | 580ms | OXIDE (+8%) |
| Parallel 3x | 1937ms | 1991ms | OXIDE (+3%) |
| WebSocket hot pair | 2181ms | N/A | OXIDE |
median of medians, 3×5 iterations. Model: gpt-5.4.
Reproduce: cd openai-oxide-node && BENCH_ITERATIONS=5 node examples/bench_node.js
Summary: openai-oxide wins 8/8 tests.
For the lowest-overhead REST paths in Node, prefer the fast-path methods:
client.createText(model, input, maxOutputTokens?)client.createStoredResponseId(model, input, maxOutputTokens?)client.createTextFollowup(model, input, previousResponseId, maxOutputTokens?)Useful commands:
pnpm install
pnpm build
pnpm test
pnpm bench
pnpm pack:preview
pnpm build writes the local .node binary next to index.js for development only. Those generated binaries are ignored by git and are not committed.
pnpm pack:preview writes a tarball preview into .preview/, which is also ignored by git.
The repository keeps the Node release separate from the Rust and Python releases.
For the Node package:
node-v0.9.6.napi-rs and publishes to npm with pnpm publish.Required secrets for npm publishing:
NPM_TOKENThe workflow uses pnpm throughout, publishes with provenance enabled, and keeps platform-specific binaries out of the repository history.
FAQs
Native Node.js bindings for openai-oxide powered by napi-rs.
The npm package openai-oxide receives a total of 21 weekly downloads. As such, openai-oxide popularity was classified as not popular.
We found that openai-oxide demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
OpenAI rotated macOS signing certificates after a malicious Axios package reached its CI pipeline in a broader software supply chain attack.

Security News
Open source is under attack because of how much value it creates. It has been the foundation of every major software innovation for the last three decades. This is not the time to walk away from it.

Security News
Socket CEO Feross Aboukhadijeh breaks down how North Korea hijacked Axios and what it means for the future of software supply chain security.