Track Potential Adoption of NPM Audit Resolve / Counterclaim / Assertions

There's discussion in the Node.js ecosystem to create a standard file format to allow Node.js module authors to write a "counterclaim" against a vulnerability with one of its direct or nested dependency.

• New RFC

  • RFC and DX: https://github.com/npm/rfcs/pull/422
  • File format: https://github.com/openjs-foundation/pkg-vuln-collab-space/pull/11

• Old RFC

  • Discussion: https://github.com/nodejs/package-maintenance/issues/386
  • RFC and file format: https://github.com/npm/rfcs/pull/18

• Other discussions

  • https://github.com/openjs-foundation/pkg-vuln-collab-space/issues/8

This is similar to CSAF 2.0 and CycloneDX VEX profiles, which allow software authors to similarly write about their evaluation on the practical impact of the vulnerability.

This issue is to keep track of these proposals.

The expected end-goal is to eventually adopt this file format alongside the CSAF 2.0 and CycloneDX VEX profiles.

Start by reading the new RFC at npm/rfcs#422 and its proposed file format in pkg-vuln-collab-space#11, then compare them with the older RFC and the CSAF 2.0 and CycloneDX VEX profiles. Done means determining whether LoopBack should adopt a format and recording the resulting decision or implementation path.