Secret exposed in proxy URL within '.npmrc' file of a Bitbucket repository

Rule Details

Cortex AppSec Rule ID	APPSEC_CICD_280
Category	Dependency Chains
Severity	HIGH

Impact

Including secrets in a .npmrc file can expose them to attackers who have gained unauthorized access to the repository, allowing them to use those secrets to access protected resources. For example, an attacker could use a secret that is used in a proxy configuration, such as the proxy or https-proxy keys, to access a proxy server and then use the proxy server to access restricted organization assets, such as an internal package registry.