References in private libraries

[yanhui2623]

Hello,I would like to ask what to do if my package.json file contains references to private libraries?

[fraxken]

By default it work by looking into npm local configuration: https://github.com/NodeSecure/cli?tab=readme-ov-file#private-registry--verdaccio

There is maybe hole into the way we manage automatically private registry, do not hesitate to tell us if things are not working as expected.

[yanhui2623]

Thank you for your reply. I have set the address of my private library, but when running the CLI scan, it seems that I still use the npm official website address to download dependencies.

[fraxken]

Are you using the latest version on NPM or directly the cloned git repo ?

[yanhui2623]

I installed it through the npm install @nodesecure/cli -g command. Also, what if the detected malicious code is a false positive? Do we have a whitelist mechanism.For example, if the result below is a false positive, how should it be handled

[fraxken]

Version on NPM is quite old, I'm currently working to publish a V4.0 to npm soon. Some warnings have more prone to false positive, the UI allow to disable them in the settings page.

[yanhui2623]

Okay, are we planning to fix the issue with private packages in the future 4.0 version, or can I just skip the private package check

[fraxken]

Not 100% sure rn, we a few contributors we are deeging the subject to see if there is bug in the current version.

[yanhui2623]

OK ,thanks for your reply.