Packages insecurely installed through “npm install” command in Azure Pipelines pipeline

Rule Details

Cortex AppSec Rule ID	APPSEC_CICD_190
Category	Dependency Chains
Severity	MEDIUM

Impact

In common package.json configurations, the "npm install" command updates and installs package versions. "npm install" doesn’t check for package integrity, allowing attackers who have gained control of a dependency package to upload a malicious version, which is then downloaded and installed automatically when running "npm install".