@helsenorge/refero
Refero is a library that uses a fhir r4 schema and creates a interactive form using helsenorge packages.
17
Versions
MIT
License
No
Install Scripts
Verified
Provenance
Supply chain provenance
Status for the latest visible version.
SLSA provenance attestation
npm registry signatures
gitHead linked
Maintainers
chriwestmariepaulinejamesbjerkholtlarskrjfreddynoaudunrueinett2039121
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| source-diff | obfuscated-file:assets/fhirpath-rpc.worker-Bu9c994N.js | AI (source-diff): Minified fhirpath web worker bundle; content matches package purpose and is covered by SLSA provenance attestation. | ai | |
| provenance | publisher-changed | AI (provenance): Transition to GitHub Actions CI/CD publisher with SLSA attestation; legitimate supply chain improvement. | ai | |
| source-diff | obfuscated-file:assets/fhirpath-rpc.worker-CpQJKvK6.js | AI (source-diff): Bundled fhirpath Web Worker; minified build artifact explicitly exported in package.json, not obfuscation. | ai | |
| dependencies | unvetted-dep:@helsenorge/core-utils | AI (dependencies): First-party helsenorge utility package; stable dependency across versions of this package. | ai | |
| dependencies | unvetted-dep:fhirpath | AI (dependencies): fhirpath is a well-known FHIR path evaluation library; expected dep for this FHIR form package. | ai | |
| phantom-deps | phantom-dep:uuid | AI (phantom-deps): uuid is a declared runtime dep; phantom-dep heuristic fires on config-only references, not a real concern. | ai | |
| phantom-deps | phantom-dep:marked | AI (phantom-deps): marked is a declared runtime dep; phantom-dep heuristic fires on config-only references, not a real concern. | ai |