Packages insecurely installed through "npm install" command

Rule Details

Cortex AppSec Rule ID	APPSEC_CICD_140
Category	Dependency Chains
Severity	MEDIUM

Impact

In common package.json configurations, the "npm install" command updates and installs package versions. "npm install" doesn't check for package integrity, allowing attackers who have gained control of a dependency package to upload a malicious version, which is then downloaded and installed automatically when running "npm install".

Recommended Solution - Buildtime

Install NPM packages through the npm ci command instead of npm install. npm ci installs exact dependency versions and checksums according to the package-lock.json file. If package names or versions in the package-lock.json file do not match those in the package.json file, npm ci will not install the package.