Secret exposed in registry URL within '.npmrc' file of a GitLab repository

Rule Details

Cortex AppSec Rule ID	APPSEC_CICD_274
Category	Dependency Chains
Severity	HIGH

Impact

Including secrets in a .npmrc file can expose them to attackers who have gained unauthorized access to the repository, allowing them to use those secrets to access protected resources. The attacker could potentially use these secrets to impersonate the owner of the secret and to perform actions on their behalf, such as pushing malicious packages to a registry which could reach the production environment or accessing internal packages on the registry.