Potential dependency confusion due to package name or scope available in registry

Rule Details

Cortex AppSec Rule ID	APPSEC_CICD_269
Category	Dependency Chains
Severity	HIGH

Impact

Attackers can discover internal package names by scanning public repositories and artifacts. Then they can upload malicious packages with names identical to an organization's internal package names and scopes, hoping that improper package fetching configuration will cause internal clients to fetch the malicious package rather than the legitimate internal package with the same name. This is known as a Dependency Confusion attack.

Recommended Solution - Buildtime

Registering internal package names or scopes in the public npmjs.com repository can help prevent misconfigured clients (such as CI servers and developer endpoints) from inadvertently fetching malicious packages from the public NPM repository.