I would argue that this is probably a false positive. NCrunch.Framework only has one package reference, which is to System.Collections.NonGeneric.

I expect this is probably being raised because NCrunch.Framework is compiled to target netstandard 1.5, which is done for compatibility with older versions of .NET Core. Running later versions of .NET/.NETCore will automatically roll forward on system packages. This means the only way you'd get a dependency on System.Net.Http 4.3.0 is if you were running on an early version of netcore and referencing the offending package yourself.

Considering the above, I don't think this is a sensible error/warning. Especially considering that NCrunch.Framework contains no network code at all and is basically just a set of attributes.