Internal NPM package is not scoped in GitLab repository

Rule Details

Cortex AppSec Rule ID	APPSEC_CICD_164
Category	Dependency Chains
Severity	MEDIUM

Impact

Any third party can publish unscoped packages to the public NPM registry. If the organization does not own the names of the internal packages on the public registry, attackers could potentially upload malicious packages to the registry with identical or similar names, hoping that clients who have not configured their ‘.npmrc' files to fetch packages from the internal registry will mistakenly download them. Scoping packages in NPM can help protect against "Dependency Confusion" and Typosquatting attacks. This is because each NPM user/organization has their own scope, and only the user/organization's owner can add packages to that scope. As a result, third parties cannot take the package name. Note: The package source displayed in the event field can be specified using one of the following methods described in these examples: • URL: https://registry.npmjs.org/example/-/example-1.0.0.tgz • Git URL: git+ssh://[e-mail]/org/repo.git • Local file path: file:../foo/bar • Local linked package: folder/package