http-proxy-middleware
The one-liner node.js proxy middleware for connect, express, next.js and more
Supply chain provenance
Status for the latest visible version.
Maintainers
Keywords
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| provenance | publisher-changed | AI (provenance): Publisher changed from chimurai personal account to GitHub Actions CI/CD with SLSA provenance — this is the expected result of adopting automated publishing from the same repo. | ai | |
| dependencies | unvetted-dep:http-proxy | AI (dependencies): http-proxy is the core dependency this package is built upon; it has been a stable, expected dependency throughout the package's history. | ai | |
| dependencies | unvetted-dep:@types/http-proxy | AI (dependencies): @types/http-proxy provides TypeScript type definitions for http-proxy; a legitimate and expected runtime dependency for this TypeScript-based package. | ai | |
| phantom-deps | phantom-dep:@types/http-proxy | AI (phantom-deps): @types/http-proxy is intentionally a runtime dep here to expose TypeScript types to consumers; not a true phantom dependency for this package. | ai |
Versions (showing 6 of 6)
| Version | Deps | Published |
|---|---|---|
| 4.0.0 | 5 / 32 | |
| 3.0.5 | 6 / 32 | |
| 2.0.9 | 5 / 29 | |
| 4.0.0-beta.3 | 5 / 32 | |
| 4.0.0-beta.2 | 5 / 30 | |
| 4.0.0-beta.0 | 5 / 31 |
v4.0.0
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v4.0.0-beta.3
2 findingsThis version was published by a different npm account than previous versions on 2026-04-05. This could indicate a legitimate maintainer transition or an account compromise.
Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v4.0.0-beta.2
2 findingsThis version was published by a different npm account than previous versions on 2026-04-04. This could indicate a legitimate maintainer transition or an account compromise.
Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v4.0.0-beta.0
2 findingsThis version was published by a different npm account than previous versions on 2026-04-03. This could indicate a legitimate maintainer transition or an account compromise.
Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.