Unencrypted channel used by '.npmrc' file of a Bitbucket repository to download dependencies from pr

Rule Details

Cortex AppSec Rule ID	APPSEC_CICD_284
Category	Dependency Chains
Severity	MEDIUM

Impact

Using HTTP instead of HTTPS to download packages through a proxy can make them vulnerable to man-in-the-middle attacks. These attacks could potentially inject malicious code into the packages, which may then be executed on the CI or developer's endpoints. This also poses a risk of exposing internal packages to tampering.