GitLab repository missing NPM lock file

Rule Details

Cortex AppSec Rule ID	APPSEC_CICD_162
Category	Dependency Chains
Severity	MEDIUM

Impact

The package-lock.json file includes information about the dependencies of a package, as well as the hashes of the downloaded packages and the source URLs. This information can be used to verify the integrity of the package installation. If a package-lock.json file is not used when running “npm ci” during the package build process, the packages will be installed without undergoing integrity checks provided by the package-lock.json file. This may lead to the package being tampered, which could potentially result in malicious code being executed in the pipeline or delivered to production.