Missing '.npmrc' file in repository

Rule Details

Cortex AppSec Rule ID	APPSEC_CICD_265
Category	Dependency Chains
Severity	MEDIUM

Impact

The .npmrc file is a configuration file used by npm, the Node Package Manager, to manage settings and options related to package installation and publishing. Failing to store the .npmrc file in the repository can make the project vulnerable during pipelines to both dependency confusion, by allowing an internal package to be fetched from the public registry, as well as insecure use of credentials.

Recommended Solution - Buildtime

Create a .npmrc file in the repository and configure it according to the best practices detailed in the npm documentation:

• Authentication related configurations must be scoped to a specific registry by prefixing with a URI fragment: https://docs.npmjs.com/cli/v9/configuring-npm/npmrc#auth-related-configuration

• Use a variable to represent tokens used in the '.npmrc' file: https://docs.npmjs.com/using-private-packages-in-a-ci-cd-workflow