@types/http-proxy-middleware

Stub TypeScript definitions entry for http-proxy-middleware, which provides its own types definitions

Supply chain provenance

Status for the latest visible version.

No SLSA provenance npm registry signatures No source commit

Without SLSA provenance there is no cryptographic link between this tarball and the public source — the axios compromise (March 2026) relied on exactly this gap.

Maintainers

types

Accepted risks

Findings the reviewer chose to accept rather than block on.

Source	Rule	Reason	Accepted by	When
phantom-deps	phantom-dep:@types/node	AI (phantom-deps): @types packages conventionally declare but don't directly import type dependencies; this is the standard pattern for TypeScript definitions.	ai	2026/04/24
phantom-deps	phantom-dep:@types/connect	AI (phantom-deps): @types packages conventionally declare but don't directly import type dependencies; this is the standard pattern for TypeScript definitions.	ai	2026/04/24
phantom-deps	phantom-dep:@types/http-proxy	AI (phantom-deps): @types packages conventionally declare but don't directly import type dependencies; this is the standard pattern for TypeScript definitions.	ai	2026/04/24
publish-pattern	dormant-publish	AI (publish-pattern): @types stubs go dormant until the upstream ships its own types; this publish pattern is expected for DefinitelyTyped stub packages.	ai	2026/04/23
phantom-deps	phantom-dep:http-proxy-middleware	AI (phantom-deps): Stub packages declare the upstream as a dep for transitive resolution without importing it; phantom-dep is a structural false positive here.	ai	2026/04/23
publish-pattern	new-deps-added	AI (publish-pattern): Adding http-proxy-middleware as a dependency is the intended behavior of a stub package redirecting to the upstream's bundled types.	ai	2026/04/23
bogus-package	bogus-package	AI (bogus-package): Stub @types packages legitimately have no code, minimal README, and tiny payloads — these signals are structural false positives for this package type.	ai	2026/04/23