Unencrypted channel used by '.npmrc' file to download dependencies from proxy

Rule Details

Cortex AppSec Rule ID	APPSEC_CICD_270
Category	Dependency Chains
Severity	MEDIUM

Impact

Using HTTP instead of HTTPS to download packages through a proxy can make them vulnerable to man-in-the-middle attacks. These attacks could potentially inject malicious code into the packages, which may then be executed on the CI or developer's endpoints. This also poses a risk of exposing internal packages to tampering.

Recommended Solution - Buildtime

It is recommended to use HTTPS for downloading dependencies. Check the .npmrc file, and if it contains configurations for downloading a package using HTTP, modify it to use HTTPS.