@medplum/agent
Medplum Agent
Supply chain provenance
Status for the latest visible version.
Maintainers
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| source-diff | encoded-string-file:dist/cjs/index.cjs | AI (source-diff): Long strings are DICOM medical data dictionaries bundled into CJS dist; not obfuscated payloads. | ai | |
| publish-pattern | dormant-publish | AI (publish-pattern): Large version jump (v4→v5) with SLSA provenance; dormancy reflects release cadence, not takeover. | ai | |
| phantom-deps | phantom-dep:winston | AI (phantom-deps): Bundled package; deps resolved at build time, not directly imported in source. | ai | |
| phantom-deps | phantom-dep:iconv-lite | AI (phantom-deps): Bundled package; deps resolved at build time, not directly imported in source. | ai | |
| phantom-deps | phantom-dep:dcmjs-dimse | AI (phantom-deps): Bundled package; deps resolved at build time, not directly imported in source. | ai | |
| phantom-deps | phantom-dep:ws | AI (phantom-deps): Bundled package; deps resolved at build time, not directly imported in source. | ai | |
| phantom-deps | phantom-dep:@medplum/core | AI (phantom-deps): Same-org monorepo dep; bundled at build time. | ai | |
| phantom-deps | phantom-dep:winston-daily-rotate-file | AI (phantom-deps): Bundled package; deps resolved at build time, not directly imported in source. | ai | |
| phantom-deps | phantom-dep:@medplum/hl7 | AI (phantom-deps): Same-org monorepo dep; bundled at build time. | ai | |
| phantom-deps | phantom-dep:semver | AI (phantom-deps): Bundled package; deps resolved at build time, not directly imported in source. | ai |
Versions (showing 15 of 15)
| Version | Deps | Published |
|---|---|---|
| 5.1.15 | 8 / 6 | |
| 5.1.14 | 8 / 6 | |
| 5.1.13 | 8 / 6 | |
| 5.1.12 | 8 / 6 | |
| 5.1.11 | 8 / 6 | |
| 5.1.10 | 8 / 6 | |
| 5.1.9 | 8 / 6 | |
| 5.1.8 | 8 / 6 | |
| 5.1.7 | 8 / 6 | |
| 4.1.18 | 5 / 6 | |
| 4.1.17 | 5 / 6 | |
| 4.1.16 | 5 / 6 | |
| 4.1.15 | 5 / 6 | |
| 4.1.14 | 5 / 6 | |
| 4.1.13 | 5 / 6 |
v5.1.15
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v5.1.14
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v5.1.13
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v5.1.12
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v5.1.11
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v5.1.10
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v5.1.9
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v5.1.8
2 findingsModified file contains 24 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.
Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v5.1.7
2 findingsModified file contains 24 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.
Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v4.1.18
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v4.1.17
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v4.1.16
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v4.1.15
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v4.1.14
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v4.1.13
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.