Secret exposed in registry URL within '.npmrc' file

Rule Details

Cortex AppSec Rule ID	APPSEC_CICD_267
Category	Dependency Chains
Severity	HIGH

Impact

Including secrets in a .npmrc file can expose them to attackers who have gained unauthorized access to the repository, allowing them to use those secrets to access protected resources. The attacker could potentially use these secrets to impersonate the owner of the secret and to perform actions on their behalf, such as pushing malicious packages to a registry which could reach the production environment or accessing internal packages on the registry

Recommended Solution - Buildtime

When exposed secrets are found it is recommended to:

• Rotate the exposed secret
• Replace the secret with an environment variable placeholder as detailed in NPM’s documentation: https://docs.npmjs.com/using-private-packages-in-a-ci-cd-workflow