registry / @amigo-ai/platform-sdk / 0.87.0

@amigo-ai/platform-sdk@0.87.0

Official TypeScript SDK for the Amigo Platform API

Static Scan Results

scanned 6d ago · by rust-scanner

Static analysis flagged 9 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessDynamicRequireFilesystem

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 64 file(s), 678 KB of source, external domains: api.platform.amigo.ai

Source & flagged code

3 flagged

dist/resources/fhir.jsView file

Lines 4-44javascript

4 *

5 * @beta New in this release; surface may evolve as the EHR adapters stabilize.

6 *

7 * Provides:

8 * - Sync status (`status`)

9 * - Bulk imports (`import`)

10 * - FHIR-shaped CRUD on resources (`resources.*`)

11 * - Patient-centric views (`patients`, `patientSummary`, `patientTimeline`)

12 * - Pre-aggregated typed views per resource type (`views.*`)

13 *

14 * All operations are workspace-scoped; the FHIR server identity is determined

15 * by the workspace's connected EHR integration.

16 */

17export class FhirResource extends WorkspaceScopedResource {

18 /** Get current FHIR sync status (server identity, last sync, counts) */

19 async getStatus() {

20 return extractData(await this.client.GET('/v1/{workspace_id}/fhir/status', {

21 params: { path: { workspace_id: this.workspaceId } },

22 }));

23 }

24 /** Trigger a FHIR import (full or partial, depending on request) */

25 async import(body) {

26 return extractData(await this.client.POST('/v1/{workspace_id}/fhir/import', {

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/resources/fhir.jsView on unpkg · L24

27 params: { path: { workspace_id: this.workspaceId } },

28 body,

29 }));

30 }

31 /** Search patients by demographics or identifiers */

32 async searchPatients(params) {

33 return extractData(await this.client.GET('/v1/{workspace_id}/fhir/patients', {

34 params: { path: { workspace_id: this.workspaceId }, query: params },

35 }));

36 }

37 /** Get a patient summary (canonical demographics + active conditions/meds) */

38 async getPatientSummary(patientId) {

39 return extractData(await this.client.GET('/v1/{workspace_id}/fhir/patients/{patient_id}/summary', {

40 params: { path: { workspace_id: this.workspaceId, patient_id: patientId } },

41 }));

42 }

43 /** Get a patient's longitudinal clinical timeline */

44 async getPatientTimeline(patientId) {

dist/index.cjsView file

Lines 33-73javascript

33 AmigoClient: () => AmigoClient,

34 AmigoError: () => AmigoError,

35 AuthenticationError: () => AuthenticationError,

36 BadRequestError: () => BadRequestError,

37 ConfigurationError: () => ConfigurationError,

38 ConflictError: () =>

Source & flagged code

3 flagged · loading source

dist/resources/fhir.jsView file

24/** Trigger a FHIR import (full or partial, depending on request) */ L25: async import(body) { L26: return extractData(await this.client.POST('/v1/{workspace_id}/fhir/import', {

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/resources/fhir.jsView on unpkg · L24

dist/index.cjsView file

53RateLimitError: () => RateLimitError, L54: ReconnectingWebSocketError: () => ReconnectingWebSocketError, L55: RefreshTokenExpiredError: () => RefreshTokenExpiredError, ... L95: isServerError: () => isServerError, L96: isUnparseableErrorBody: () => isUnparseableErrorBody, L97: isValidationError: () => isValidationError, ... L272: try { L273: rawBody = await response.text(); L274: } catch { ... L2411: * for await (const event of client.conversations.streamTurn(convId, { message: "Hello" })) { L2412: * if (event.event === "token") process.stdout.write(event.text); L2413: * else if (event.event === "done") break;

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/index.cjsView on unpkg · L53

•matchType = previous_version_dangerous_delta matchedPackage = @amigo-ai/platform-sdk@0.85.0 matchedIdentity = npm:QGFtaWdvLWFpL3BsYXRmb3JtLXNkaw:0.85.0 similarity = 0.968 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/index.cjsView on unpkg

Findings

2 High2 Medium5 Low

HighSandbox Evasion Gated Capabilitydist/index.cjs

HighPrevious Version Dangerous Deltadist/index.cjs

MediumDynamic Requiredist/resources/fhir.js

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

3 flagged

dist/resources/fhir.jsView file

Lines 4-44javascript

4 *

5 * @beta New in this release; surface may evolve as the EHR adapters stabilize.

6 *

7 * Provides:

8 * - Sync status (`status`)

9 * - Bulk imports (`import`)

10 * - FHIR-shaped CRUD on resources (`resources.*`)

11 * - Patient-centric views (`patients`, `patientSummary`, `patientTimeline`)

12 * - Pre-aggregated typed views per resource type (`views.*`)

13 *

14 * All operations are workspace-scoped; the FHIR server identity is determined

15 * by the workspace's connected EHR integration.

16 */

17export class FhirResource extends WorkspaceScopedResource {

18 /** Get current FHIR sync status (server identity, last sync, counts) */

19 async getStatus() {

20 return extractData(await this.client.GET('/v1/{workspace_id}/fhir/status', {

21 params: { path: { workspace_id: this.workspaceId } },

22 }));

23 }

24 /** Trigger a FHIR import (full or partial, depending on request) */

25 async import(body) {

26 return extractData(await this.client.POST('/v1/{workspace_id}/fhir/import', {

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/resources/fhir.jsView on unpkg · L24

27 params: { path: { workspace_id: this.workspaceId } },

28 body,

29 }));

30 }

31 /** Search patients by demographics or identifiers */

32 async searchPatients(params) {

33 return extractData(await this.client.GET('/v1/{workspace_id}/fhir/patients', {

34 params: { path: { workspace_id: this.workspaceId }, query: params },

35 }));

36 }

37 /** Get a patient summary (canonical demographics + active conditions/meds) */

38 async getPatientSummary(patientId) {

39 return extractData(await this.client.GET('/v1/{workspace_id}/fhir/patients/{patient_id}/summary', {

40 params: { path: { workspace_id: this.workspaceId, patient_id: patientId } },

41 }));

42 }

43 /** Get a patient's longitudinal clinical timeline */

44 async getPatientTimeline(patientId) {

dist/index.cjsView file

Lines 33-73javascript

33 AmigoClient: () => AmigoClient,

34 AmigoError: () => AmigoError,

35 AuthenticationError: () => AuthenticationError,

36 BadRequestError: () => BadRequestError,

37 ConfigurationError: () => ConfigurationError,

38 ConflictError: () =>