NPM package lock file verifies integrity with weak hash algorithm (BitBucket)

Rule Details

Cortex AppSec Rule ID	APPSEC_CICD_176
Category	Dependency Chains
Severity	LOW

Impact

Old versions of package-lock.json files using SHA-1 to verify the integrity of downloaded dependencies are vulnerable to collision attacks in which two inputs can produce the same output, meaning that attackers can create a malicious package with the same hash of a legitimate package, bypassing the integrity validation. An attacker who has gained access to a maintainer account could trick a pipeline that uses "npm ci" to securely install a package and verify the dependencies integrity by replacing a legitimate package with a malicious version that has the same hash, thereby introducing malicious code which could potentially reach production. Note: Due to SHA-1 vulnerabilities, it was deprecated by NIST in 2011.