Repository missing NPM lock file package-lock.json

Rule Details

Cortex AppSec Rule ID	APPSEC_CICD_158
Category	Dependency Chains
Severity	MEDIUM

Impact

The package-lock.json file includes information about the dependencies of a package, as well as the hashes of the downloaded packages and the source URLs. This information can be used to verify the integrity of the package installation. If a package-lock.json file is not used when running "npm ci" during the package build process, the packages will be installed without undergoing integrity checks provided by the package-lock.json file. This may lead to the package being tampered, which could potentially result in malicious code being executed in the pipeline or delivered to production.

Recommended Solution - Buildtime

It is recommended to store the package-lock.json file in the repository. If the lock file already exists in the local repository, make sure it’s not listed in the .gitignore file. If the file doesn’t exist you can generate it by issuing the npm install --package-lock command.