Unencrypted channel used by '.npmrc' file of a GitLab repository to download dependencies from proxy

Rule Details

Cortex AppSec Rule ID	APPSEC_CICD_277
Category	Dependency Chains
Severity	MEDIUM

Impact

Using HTTP instead of HTTPS to download packages through a proxy can make them vulnerable to man-in-the-middle attacks. These attacks could potentially inject malicious code into the packages, which may then be executed on the CI or developer's endpoints. This also poses a risk of exposing internal packages to tampering.