registry / @medplum/cli / 5.1.26

@medplum/cli@5.1.26

Medplum Command Line Interface

Static Scan Results

scanned 59m ago · by rust-scanner

Static analysis flagged 11 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetwork

Supply chain

HighEntropyStringsMinifiedUrlStrings

ManifestNo manifest risk signals triggered.

scanned 2 file(s), 227 KB of source, external domains: api.github.com, api.medplum.com, app.medplum.com, hl7.org, registry.npmjs.org, www.medplum.com

Source & flagged code

4 flagged

dist/esm/index.mjsView file

Lines 1-23javascript

1#!/usr/bin/env node

2var Zo=Object.create;var gt=Object.defineProperty;var ei=Object.getOwnPropertyDescriptor;var ti=Object.getOwnPropertyNames;var ri=Object.getPrototypeOf,ni=Object.prototype.hasOwnProperty;var si=(e,t,r)=>t in e?gt(e,t,{enumerable:!0,configurable:!0,writable:!0,value:r}):e[t]=r;var w=(e,t)=>()=>{try{return t||e((t={exports:{}}).exports,t),t.exports}catch(r){throw t=0,r}};var oi=(e,t,r,n)=>{if(t&&typeof t=="object"||typeof t=="function")for(let s of ti(t))!ni.call(e,s)&&s!==r&&gt(e,s,{get:()=>t[s],enumerable:!(n=ei(t,s))||n.enumerable});return e};var Sr=(e,t,r)=>(r=e!=null?Zo(ri(e)):{},oi(t||!e|| ...

3${h.length} successful response(s):

4`),o?h.length?o(h):console.info("No successful responses received"):console.table(h.length?h:"No successful responses received"),console.info(),re.length&&(console.info(`${re.length} failed response(s):`),console.info(),console.table(re))}async function mn(e,t,r){if(!(t||r.criteria))throw new Error("This command requires either an [agentId] or a --criteria <criteria> flag");if(t&&r.criteria)throw new Error("Ambiguous arguments and options combination; [agentId] arg and --criteria <criteria> flag are mutually exclusive");let n;if(t)n=t;else{hn(r.criteria);let s=await e.search("Agent",`${r.crite ...

5`)}function I(e){c(`

High

Child Process

Package source references child process execution.

dist/esm/index.mjsView on unpkg · L3

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/esm/index.mjsView on unpkg · L1

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/esm/index.mjsView on unpkg · L1

6`+e+`

7`)}function N(e,t=""){return new Promise(r=>{et.question(e+(t?" ("+t+")":"")+" ",n=>{r(n||t.toString())})})}async function nt(e,t,r=""){let n=e+" ["+t.map(s=>s===r?"("+s+")":s).join("|")+"]";for(;;){let s=await N(n)||r;if(t.includes(s))return s;c("Please choose one of the following options: "+t.join(", "))}}async function ae(e,t,r){return Number.parseInt(await nt(e,t.map(n=>n.toString()),r.toString()),10)}async function z(e){return(await nt(e,["y","n"])).toLowerCase()==="y"}async function Ie(e){if(!await z(e))throw c("Exiting..."),new Error("User cancelled")}var st=new lo({}),Bu=new Ou({region ...

9Configuration values come from a file named **medplum.<tag>.config.server.json** where **<tag>** is the Medplum stack tag.

11`+te.yellow("**Services must be restarted to apply changes.**"))).argument("<tag>","The Medplum stack tag").option("--file [file]",_t("File to provide overrides for **apiPort**, **baseUrl**, **appDomainName** and **storageDomainName** values that appear in the config file.")).option("--dryrun","Displays the operations that would be performed using the specified command without actually running them.").option("--yes","Automatically confirm the update").action(Po),y(e,new g("update-server").

13 ${o.join(`

14 `)}`,{cause:s})}ar.description("Saves the bot").argument("<botName>").action(async(e,t)=>{let r=await A(t);await pt(r,e)});cr.description("Deploy the bot to AWS").argument("<botName>").action(async(e,t)=>{let r=await A(t);await pt(r,e,!0)});lr.arguments("<botName> <projectId> <sourceFile> <distFile>").description("Creates and saves the bot").action(async(e,t,r,n,s)=>{let o=await A(s);await Nt(o,e,t,r,n)});import{EMPTY as No}from"@medplum/core";import{createReadStream as jp,createWriteStream as Fp}from"node:fs";import{resolve as ko}from"node:path";import{createInterface as Bp}from"node:read ...

15`))}finally{await s.close()}}),pd=new g("listen").description("Starts an HL7 v2 MLLP server").argument("<port>").option("--encoding <encoding>","The encoding to use").action(async(e,t)=>{await new Wo(n=>{n.addEventListener("message",({message:s})=>{console.log(s.toString().replaceAll("\r",`

16`)),n.send(s.buildAck())})}).start(Number.parseInt(e,10),t.encoding),console.log("Listening on port "+e)}),ft=new g("hl7");y(ft,ud);y(ft,pd);function dd(){let e=ad(new Date),t=Date.now().toString();return`MSH|^~\\&|ADTSYS|HOSPITAL|RECEIVER|DEST|${e

17EVN|A01|${e}||

18PID|1|12345|12345^^^HOSP^MR|123456|DOE^JOHN^MIDDLE^SUFFIX|19800101|M|||123 STREET^APT 4B^CITY^ST^12345-6789||555-555-5555||S|

19PV1|1|I|2000^2012^01||||12345^DOCTOR^DOC||||||||||1234567^DOCTOR^DOC||AMB|||||||||||||||||||||||||202309280900|`}import{readdirSync as md}from"node:fs";import{homedir as fd}from"node:os";import{resolve as hd}from"node:path";var Ko=new g("set"),qo=new g("remove"),Ho=new g("list"),Go=new g("describe"),de

21`);console.log(r)}Jo.description("Project you are currently on").action(async e=>{let r=(await A(e)).getActiveLogin();if(!r)throw new Error("Unauthenticated: run `npx medplum login` to login");console.log(`${r.project.display} (${r.project.reference})`)});Xo.description("Switching to another project from the current one").argument("<projectId>").action(async(e,t)=>{let r=await A(t);await wd(r,e)});zo.description("Invite a member to your current project (run npx medplum project current to confirm)").arguments("<firstName> <lastName> <email>").option("--send-email","If you want to send the email ...

22`)}async function Ed(e,t,r){await r.invite(e,t),t.sendEmail&&console.log("Email sent"),console.log("See your users at https://app.medplum.com/admin/users")}import{convertToTransactionBundle as Sd}from"@medplum/core";var dr=new g("delete"),mr=new g("get"),fr

23`):process.stderr.write(`Error: ${Er(e)}

Long lines were clipped for display.

dist/cjs/index.cjsView file

Lines 1-26javascript

1#!/usr/bin/env node

2"use strict";var Gi=Object.create;var Oe=Object.defineProperty;var Vi=Object.getOwnPropertyDescriptor;var Ji=Object.getOwnPropertyNames;var Xi=Object.getPrototypeOf,zi=Object.prototype.hasOwnProperty;var Yi=(e,t,r

Source & flagged code

4 flagged · loading source

dist/esm/index.mjsView file

3${h.length} successful response(s): L4: `),o?h.length?o(h):console.info("No successful responses received"):console.table(h.length?h:"No successful responses received"),console.info(),re.length&&(console.info(`${re.lengt... L5: `)}function I(e){c(`

High

Child Process

Package source references child process execution.

dist/esm/index.mjsView on unpkg · L3

1#!/usr/bin/env node L2: var Zo=Object.create;var gt=Object.defineProperty;var ei=Object.getOwnPropertyDescriptor;var ti=Object.getOwnPropertyNames;var ri=Object.getPrototypeOf,ni=Object.prototype.hasOwnPr... L3: ${h.length} successful response(s): L4: `),o?h.length?o(h):console.info("No successful responses received"):console.table(h.length?h:"No successful responses received"),console.info(),re.length&&(console.info(`${re.lengt... L5: `)}function I(e){c(`

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/esm/index.mjsView on unpkg · L1

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/esm/index.mjsView on unpkg · L1

dist/cjs/index.cjsView file

6`+e+` L7: `)}function k(e,t=""){return new Promise(r=>{Et.question(e+(t?" ("+t+")":"")+" ",n=>{r(n||t.toString())})})}async function At(e,t,r=""){let n=e+" ["+t.map(s=>s===r?"("+s+")":s).joi... L8:

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/cjs/index.cjsView on unpkg · L6

Findings

4 High3 Medium4 Low

HighChild Processdist/esm/index.mjs

HighSame File Env Network Executiondist/esm/index.mjs

HighCommand Output Exfiltrationdist/esm/index.mjs

HighRuntime Package Installdist/cjs/index.cjs

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

4 flagged

dist/esm/index.mjsView file

Lines 1-23javascript

1#!/usr/bin/env node

3${h.length} successful response(s):

5`)}function I(e){c(`

High

Child Process

Package source references child process execution.

dist/esm/index.mjsView on unpkg · L3

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/esm/index.mjsView on unpkg · L1

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/esm/index.mjsView on unpkg · L1

6`+e+`

9Configuration values come from a file named **medplum.<tag>.config.server.json** where **<tag>** is the Medplum stack tag.

13 ${o.join(`

17EVN|A01|${e}||

18PID|1|12345|12345^^^HOSP^MR|123456|DOE^JOHN^MIDDLE^SUFFIX|19800101|M|||123 STREET^APT 4B^CITY^ST^12345-6789||555-555-5555||S|

23`):process.stderr.write(`Error: ${Er(e)}

Long lines were clipped for display.

dist/cjs/index.cjsView file

Lines 1-26javascript

1#!/usr/bin/env node