Secrets found in NPM dependency download URL

Rule Details

Cortex AppSec Rule ID	APPSEC_CICD_161
Category	Dependency Chains
Severity	HIGH

Impact

Including secrets in a NPM dependency download URL, which is found in the package-lock.json file, can allow an attacker who has gained access to the repository to gain unauthorized access to the package or to resources that are protected by the secret. The attacker could potentially use these secrets to impersonate the owner of the secret and to perform actions on their behalf, such as pushing malicious code which could reach the production environment.

Recommended Solution - Buildtime

Remove the URLs that contain secrets from the package-lock.json file. Also, check the .npmrc file, and if it contains configurations to download a package using plain-text credentials, remove the configuration. Use an alternative method for authentication to provide access to a private registry:

1. Execute npm uninstall <package> to remove the existing package.
2. Create a .npmrc file that contains authentication configurations using the following guide.
3. Execute npm install using the package name instead of a URL to reinstall the package.