NPM package lock file verifies integrity with weak hash algorithm

Rule Details

Cortex AppSec Rule ID	APPSEC_CICD_174
Category	Dependency Chains
Severity	LOW

Impact

Old versions of package-lock.json files using SHA-1 to verify the integrity of downloaded dependencies are vulnerable to collision attacks in which two inputs can produce the same output, meaning that attackers can create a malicious package with the same hash of a legitimate package, bypassing the integrity validation. An attacker who has gained access to a maintainer account could trick a pipeline that uses "npm ci" to securely install a package and verify the dependencies integrity by replacing a legitimate package with a malicious version that has the same hash, thereby introducing malicious code which could potentially reach production. Note: Due to SHA-1 vulnerabilities, it was deprecated by NIST in 2011.

Recommended Solution - Buildtime

Update the SHA-1 hash to SHA-512 in the package-lock.json file:

1. Open the local repository.
2. Ensure npm CLI is updated to the latest version: run npm install -g npm@latest.
3. Delete the node_modules folder (if it exists).
4. Delete the package-lock.json file.
5. Run npm i.