Internal NPM package is not scoped

Rule Details

Cortex AppSec Rule ID	APPSEC_CICD_160
Category	Dependency Chains
Severity	MEDIUM

Impact

Any third party can publish unscoped packages to the public NPM registry. If the organization does not own the names of the internal packages on the public registry, attackers could potentially upload malicious packages to the registry with identical or similar names, hoping that clients who have not configured their '.npmrc' files to fetch packages from the internal registry will mistakenly download them. Scoping packages in NPM can help protect against "Dependency Confusion" and Typosquatting attacks. This is because each NPM user/organization has their own scope, and only the user/organization's owner can add packages to that scope. As a result, third parties cannot take the package name.

Recommended Solution - Buildtime

Reduce the risk of Dependency Confusion and Typosquatting attacks on your internal NPM packages by using organization-controlled scopes on the public NPM registry. This will ensure that any packages fetched by your internal clients are legitimate versions under your organization’s control. To upload a scoped package to npmjs.com you need to own an NPM organization with the same name as the scope. Then, edit the name field in the package.json file to @scopename/packagename and publish the package. Reinstall the package on all repositories that depend on it.