Unencrypted channel used by '.npmrc' file of a bitbucket repository to download dependencies from re

Rule Details

Cortex AppSec Rule ID	APPSEC_CICD_285
Category	Dependency Chains
Severity	MEDIUM

Impact

Using HTTP instead of HTTPS to download packages from a registry can make them vulnerable to man-in-the-middle attacks. These attacks could potentially inject malicious code into the packages, which may then be executed on the CI or developer's endpoints. This also poses a risk of exposing internal packages to tampering.