@bcgov/csit-microcks-backend-backstage-plugin

This Backstage backend plugin synchronizes API mocks defined in a repository into a **Microcks** server.

Supply chain provenance

Status for the latest visible version.

Without SLSA provenance there is no cryptographic link between this tarball and the public source — the axios compromise (March 2026) relied on exactly this gap.

Maintainers

Accepted risks

Findings the reviewer chose to accept rather than block on.

Source	Rule	Reason	Accepted by	When
npm-metadata	suspicious-initial-version	AI (npm-metadata): 0.0.0 is the standard initial version for Backstage plugin packages in the @bcgov org; not indicative of malicious intent.	ai	2026/04/29
phantom-deps	phantom-dep:zod	AI (phantom-deps): Backstage backstage:^ version specifier causes phantom-dep false positives; dep is legitimately declared.	ai	2026/04/29
phantom-deps	phantom-dep:express	AI (phantom-deps): Same backstage:^ false positive pattern; express is a standard Backstage backend plugin dependency.	ai	2026/04/29
phantom-deps	phantom-dep:@backstage/types	AI (phantom-deps): Backstage backstage:^ specifier causes phantom-dep false positive.	ai	2026/04/29
phantom-deps	phantom-dep:@backstage/errors	AI (phantom-deps): Backstage backstage:^ specifier causes phantom-dep false positive.	ai	2026/04/29
phantom-deps	phantom-dep:express-promise-router	AI (phantom-deps): Standard Backstage backend plugin dependency; phantom-dep false positive.	ai	2026/04/29
phantom-deps	phantom-dep:@backstage/backend-defaults	AI (phantom-deps): Backstage backstage:^ specifier causes phantom-dep false positive.	ai	2026/04/29

Version	Deps	Published
0.0.0	9 / 5	2026-04-21