Dependency Chains

Rule Name	AppSec Rule ID	Severity
Packages insecurely installed through “npm install” command in GitHub Actions pipeline	APPSEC_CICD_137	MEDIUM
Packages insecurely installed through “npm install” command in GitLab CI pipeline	APPSEC_CICD_139	MEDIUM
Packages insecurely installed through "npm install" command	APPSEC_CICD_140	MEDIUM
Packages insecurely installed through “npm install” command in Circle CI pipeline	APPSEC_CICD_141	MEDIUM
Repository missing NPM lock file package-lock.json	APPSEC_CICD_158	MEDIUM
Unencrypted channel used to download dependencies from NPM registry	APPSEC_CICD_159	MEDIUM
Internal NPM package is not scoped	APPSEC_CICD_160	MEDIUM
Secrets found in NPM dependency download URL	APPSEC_CICD_161	HIGH
GitLab repository missing NPM lock file	APPSEC_CICD_162	MEDIUM
Unencrypted channel used in GitLab repository to download dependencies from NPM registry	APPSEC_CICD_163	MEDIUM
Internal NPM package is not scoped in GitLab repository	APPSEC_CICD_164	MEDIUM
Secrets found in NPM dependency download URL in GitLab repository	APPSEC_CICD_165	HIGH
BitBucket repository missing NPM lock file	APPSEC_CICD_166	MEDIUM
Unencrypted channel used in BitBucket repository to download dependencies from NPM registry	APPSEC_CICD_167	MEDIUM
Internal NPM package is not scoped in BitBucket repository	APPSEC_CICD_168	MEDIUM
Secrets found in NPM dependency download URL in BitBucket repository	APPSEC_CICD_169	HIGH
Azure repository missing NPM lock file	APPSEC_CICD_170	MEDIUM
Unencrypted channel used in Azure repository to download dependencies from NPM registry	APPSEC_CICD_171	MEDIUM
Internal NPM package is not scoped in Azure repository	APPSEC_CICD_172	MEDIUM
Secrets found in NPM dependency download URL in Azure repository	APPSEC_CICD_173	HIGH
NPM package lock file verifies integrity with weak hash algorithm	APPSEC_CICD_174	LOW
NPM package lock file verifies integrity with weak hash algorithm (Gitlab)	APPSEC_CICD_175	LOW
NPM package lock file verifies integrity with weak hash algorithm (BitBucket)	APPSEC_CICD_176	LOW
NPM package lock file verifies in Azure repository integrity with weak hash algorithm	APPSEC_CICD_177	LOW
Packages insecurely installed through “npm install” command in Azure Pipelines pipeline	APPSEC_CICD_190	MEDIUM
Possible Python typosquatting detected	APPSEC_CICD_200	HIGH
Possible Python typosquatting detected in a GitLab repository	APPSEC_CICD_201	HIGH
Possible Python typosquatting detected in a Bitbucket repository	APPSEC_CICD_202	HIGH
Possible Python typosquatting detected in an Azure repository	APPSEC_CICD_203	HIGH
Missing '.npmrc' file in repository	APPSEC_CICD_265	MEDIUM
Secret exposed in proxy URL within '.npmrc' file	APPSEC_CICD_266	HIGH
Secret exposed in registry URL within '.npmrc' file	APPSEC_CICD_267	HIGH
Deprecated package used in NPM project	APPSEC_CICD_268	HIGH
Potential dependency confusion due to package name or scope available in registry	APPSEC_CICD_269	HIGH
Unencrypted channel used by '.npmrc' file to download dependencies from proxy	APPSEC_CICD_270	MEDIUM
Unencrypted channel used by '.npmrc' file of a GitHub repository to download dependencies from registry	APPSEC_CICD_271	MEDIUM
Missing '.npmrc' file in GitLab repository	APPSEC_CICD_272	MEDIUM
Secret exposed in proxy URL within '.npmrc' file of a Gitlab repository	APPSEC_CICD_273	HIGH
Secret exposed in registry URL within '.npmrc' file of a GitLab repository	APPSEC_CICD_274	HIGH
Deprecated package used in NPM project of a GitLab repository	APPSEC_CICD_275	HIGH
Potential dependency confusion in a GitLab repository due to package name or scope available in registry	APPSEC_CICD_276	HIGH
Unencrypted channel used by '.npmrc' file of a GitLab repository to download dependencies from proxy	APPSEC_CICD_277	MEDIUM
Unencrypted channel used by '.npmrc' file of a GitLab repository to download dependencies from registry	APPSEC_CICD_278	MEDIUM
Missing '.npmrc' file in Bitbucket repository	APPSEC_CICD_279	MEDIUM
Secret exposed in proxy URL within '.npmrc' file of a Bitbucket repository	APPSEC_CICD_280	HIGH
Secret exposed in registry URL within '.npmrc' file of a Bitbucket repository	APPSEC_CICD_281	HIGH
Deprecated package used in NPM project of a Bitbucket repository	APPSEC_CICD_282	HIGH
Potential dependency confusion in a Bitbucket repository due to package name or scope available in registry	APPSEC_CICD_283	HIGH
Unencrypted channel used by '.npmrc' file of a Bitbucket repository to download dependencies from proxy	APPSEC_CICD_284	MEDIUM
Unencrypted channel used by '.npmrc' file of a bitbucket repository to download dependencies from registry	APPSEC_CICD_285	MEDIUM
Missing '.npmrc' file in Azure repository	APPSEC_CICD_286	MEDIUM
Secret exposed in proxy URL within '.npmrc' file of an Azure repository	APPSEC_CICD_287	HIGH
Secret exposed in registry URL within '.npmrc' file of an Azure repository	APPSEC_CICD_288	HIGH
Deprecated package used in NPM project of an Azure repository	APPSEC_CICD_289	HIGH
Potential dependency confusion in an Azure repository due to package name or scope available in registry	APPSEC_CICD_290	HIGH
Unencrypted channel used by '.npmrc' file of an Azure repository to download dependencies from proxy	APPSEC_CICD_291	MEDIUM
Unencrypted channel used by '.npmrc' file of an Azure repository to download dependencies from registry	APPSEC_CICD_292	MEDIUM
NPM project contains unused dependencies	APPSEC_CICD_301	LOW
NPM project contains unused dependencies in a GitLab repository	APPSEC_CICD_302	LOW
NPM project contains unused dependencies in a Bitbucket repository	APPSEC_CICD_303	LOW
NPM project contains unused dependencies in an Azure Repos repository	APPSEC_CICD_304	LOW
NPM package downloaded from git without commit hash reference	APPSEC_CICD_313	MEDIUM
NPM package downloaded from git without commit hash reference in a GitLab repository	APPSEC_CICD_314	MEDIUM
NPM package downloaded from git without commit hash reference in a Bitbucket repository	APPSEC_CICD_315	MEDIUM
NPM package downloaded from git without commit hash reference in an Azure Repos repository	APPSEC_CICD_316	MEDIUM