Unencrypted channel used in Azure repository to download dependencies from NPM registry

Rule Details

Cortex AppSec Rule ID	APPSEC_CICD_171
Category	Dependency Chains
Severity	MEDIUM

Impact

Downloading packages using HTTP instead of HTTPS can make them vulnerable to man-in-the-middle attacks, which could potentially allow malicious code to be injected into the packages and executed on the CI or developer's endpoints. This could also expose internal packages to tampering. The dependency's download URL can be found in the package-lock.json file.