@hmcts/rpx-xui-node-lib
Common nodejs library components for XUI
6
Versions
MIT
License
No
Install Scripts
Attested
Provenance
Supply chain provenance
Status for the latest visible version.
SLSA provenance attestation (unverified)
npm registry signatures
gitHead linked
Maintainers
timja-hmctstimjajenkins-reform-hmctsplayfair0319thomast1906hmctsnpm
Keywords
XUInodeauthentication
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| phantom-deps | phantom-dep:deepmerge | AI (phantom-deps): deepmerge is a runtime dep used in config; phantom-dep heuristic is a false positive here. | ai | |
| dependencies | unvetted-dep:jest-mock-axios | AI (dependencies): jest-mock-axios is a standard test utility; stable false positive for this package. | ai | |
| dependencies | unvetted-dep:session-file-store | AI (dependencies): session-file-store is a well-known express-session backend; no malware indicators. | ai | |
| phantom-deps | phantom-dep:@hapi/joi | AI (phantom-deps): Dual joi/@hapi/joi pattern common in this codebase; stable false positive. | ai | |
| phantom-deps | phantom-dep:jest-mock-axios | AI (phantom-deps): Listed as runtime dep but used via jest config; stable false positive for this package. | ai | |
| phantom-deps | phantom-dep:jest-ts-auto-mock | AI (phantom-deps): Used via jest transform config, not direct import; stable false positive. | ai | |
| phantom-deps | phantom-dep:caller-path | AI (phantom-deps): caller-path is explicitly listed as a runtime dependency in package.json; phantom-dep is a false positive for this package. | ai |