Security News
Research
Data Theft Repackaged: A Case Study in Malicious Wrapper Packages on npm
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
cql-exec-fhir
Advanced tools
This project establishes a FHIR-based data source module for use with the CQL Execution Engine. Currently, FHIR 1.0.2 (DSTU2), FHIR 3.0.0 (STU3), FHIR 4.0.0 ,and FHIR 4.0.1 (R4) are supported.
To use this project, you should perform the following steps:
npm install
The FHIR Data Source expects each patient to be represented as a single FHIR Bundle containing all of the patient's relevant data. The FHIR Data Source does not query FHIR servers, but rather, expects the Bundles to be passed to it.
The following is a simple example of how it would be used to execute over two patients:
const cqlfhir = require('cql-exec-fhir');
// Code setting up the CQL library, executor, etc, and getting the patient data as a bundle
// ...
const patientSource = cqlfhir.PatientSource.FHIRv401(); // or .FHIRv102() or .FHIRv300() or .FHIRv400()
patientSource.loadBundles([patient01, patient02]);
const results = executor.exec(patientSource);
NOTE: This feature will only work with cql-execution
version 2.4.1 or higher.
If desired, the FHIR Data Source can be configured to use the meta.profile
list on FHIR resources as a source of truth for whether or not that resource should be included when looking through the Bundle of data.
const cqlfhir = require('cql-exec-fhir');
// Including "requireProfileTagging: true" in an object passed in to the constructor enables the trusted environment
const patientSource = cqlfhir.PatientSource.FHIRv401({
requireProfileTagging: true,
}); // or .FHIRv102() or .FHIRv300() or .FHIRv400()
As an example, if an ELM Retrieve expression asks for a FHIR Condition Resource with profile http://hl7.org/fhir/us/core/StructureDefinition/us-core-condition-encounter-diagnosis
, the default behavior of the FHIR Data Source is to find any FHIR Condition resource.
With the trusted environment enabled however, the FHIR Data Source will only find resources with the string 'http://hl7.org/fhir/us/core/StructureDefinition/us-core-condition-encounter-diagnosis'
included in their meta.profile
lists.
If you are passing in individual FHIR resources to the execution engine as parameters, you can use FHIRWrapper to convert the raw json FHIR resources into FHIRObjects that work with the execution engine.
Example:
const cqlfhir = require('cql-exec-fhir');
const fhirWrapper = cqlfhir.FHIRWrapper.FHIRv401(); // or .FHIRv102() or .FHIRv300() or .FHIRv400()
const conditionRawResource = { "resourceType": "Condition", "id": "f201", "clinicalStatus": "active", ... }
const conditionFhirObject = fhirWrapper.wrap(conditionResource)
// Now conditionFhirObject can be passed into the cql execution engine
To run the automated unit tests, execute the following command:
$ npm test
To encourage quality and consistency within the code base, all code should pass eslint without any warnings. Many text editors can be configured to automatically flag eslint violations. We also provide an npm script for running eslint on the project. To check your code against eslint's rules, execute the following command:
$ npm run lint
To automatically fix code that violates eslint's rules:
$ npm run lint:fix
To encourage quality and consistency within the code base, all code should also be formatted using Prettier. Many text editors can be configured to automatically reformat code using Prettier on save. We also provide an npm script for running prettier on the project. To check your code against Prettier's rules, execute the following command:
$ npm run prettier
To automatically fix any code that violates Prettier's rules:
$ npm run prettier:fix
To run the unit tests, linter, and prettier all in one shot, execute the following command:
$ npm run test:plus
FAQs
Provides a FHIR-based data source for use w/ CQL
The npm package cql-exec-fhir receives a total of 186 weekly downloads. As such, cql-exec-fhir popularity was classified as not popular.
We found that cql-exec-fhir demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
Research
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
Research
Security News
Attackers used a malicious npm package typosquatting a popular ESLint plugin to steal sensitive data, execute commands, and exploit developer systems.
Security News
The Ultralytics' PyPI Package was compromised four times in one weekend through GitHub Actions cache poisoning and failure to rotate previously compromised API tokens.