Secrets found in NPM dependency download URL in BitBucket repository

Rule Details

Cortex AppSec Rule ID	APPSEC_CICD_169
Category	Dependency Chains
Severity	HIGH

Impact

Including secrets in a NPM dependency download URL, which is found in the package-lock.json file, can allow an attacker who has gained access to the repository to gain unauthorized access to the package or to resources that are protected by the secret. The attacker could potentially use these secrets to impersonate the owner of the secret and to perform actions on their behalf, such as pushing malicious code which could reach the production environment.