Secret exposed in proxy URL within '.npmrc' file

Rule Details

Cortex AppSec Rule ID	APPSEC_CICD_266
Category	Dependency Chains
Severity	HIGH

Impact

Including secrets in a .npmrc file can expose them to attackers who have gained unauthorized access to the repository, allowing them to use those secrets to access protected resources. For example, an attacker could use a secret that is used in a proxy configuration, such as the proxy or https-proxy keys, to access a proxy server and then use the proxy server to access restricted organization assets, such as an internal package registry.

Recommended Solution - Buildtime

When exposed secrets are found it is recommended to:

• Rotate the exposed secret
• Replace the secret with an environment variable placeholder as detailed in NPM’s documentation: https://docs.npmjs.com/using-private-packages-in-a-ci-cd-workflow