Unencrypted channel used to download dependencies from NPM registry

Rule Details

Cortex AppSec Rule ID	APPSEC_CICD_159
Category	Dependency Chains
Severity	MEDIUM

Impact

Downloading packages using HTTP instead of HTTPS can make them vulnerable to man-in-the-middle attacks, which could potentially allow malicious code to be injected into the packages and executed on the CI or developer's endpoints. This could also expose internal packages to tampering. The dependency's download URL can be found in the package-lock.json file.

Recommended Solution - Buildtime

Check the .npmrc file, and if it contains configurations for downloading a package using HTTP, modify it to use HTTPS. To update the dependency URL, uninstall the existing package using the npm uninstall <package> command, and then re-install the updated package using npm install over an encrypted channel.