You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Thank you for your reply. I have set the address of my private library, but when running the CLI scan, it seems that I still use the npm official website address to download dependencies.
I installed it through the npm install @nodesecure/cli -g command. Also, what if the detected malicious code is a false positive? Do we have a whitelist mechanism.For example, if the result below is a false positive, how should it be handled
Version on NPM is quite old, I'm currently working to publish a V4.0 to npm soon. Some warnings have more prone to false positive, the UI allow to disable them in the settings page.
Activity
fraxken commentedon Mar 18, 2026
By default it work by looking into npm local configuration: https://github.com/NodeSecure/cli?tab=readme-ov-file#private-registry--verdaccio
There is maybe hole into the way we manage automatically private registry, do not hesitate to tell us if things are not working as expected.
yanhui2623 commentedon Mar 19, 2026
Thank you for your reply. I have set the address of my private library, but when running the CLI scan, it seems that I still use the npm official website address to download dependencies.
fraxken commentedon Mar 19, 2026
Are you using the latest version on NPM or directly the cloned git repo ?
yanhui2623 commentedon Mar 20, 2026
I installed it through the
npm install @nodesecure/cli -gcommand. Also, what if the detected malicious code is a false positive? Do we have a whitelist mechanism.For example, if the result below is a false positive, how should it be handledfraxken commentedon Mar 20, 2026
Version on NPM is quite old, I'm currently working to publish a V4.0 to npm soon. Some warnings have more prone to false positive, the UI allow to disable them in the settings page.
yanhui2623 commentedon Mar 23, 2026
Okay, are we planning to fix the issue with private packages in the future 4.0 version, or can I just skip the private package check
fraxken commentedon Mar 23, 2026
Not 100% sure rn, we a few contributors we are deeging the subject to see if there is bug in the current version.
yanhui2623 commentedon Mar 24, 2026
OK ,thanks for your reply.