Missing '.npmrc' file in Azure repository

Rule Details

Cortex AppSec Rule ID	APPSEC_CICD_286
Category	Dependency Chains
Severity	MEDIUM

Impact

The .npmrc file is a configuration file used by npm, the Node Package Manager, to manage settings and options related to package installation and publishing. Failing to store the .npmrc file in the repository can make the project vulnerable during pipelines to both dependency confusion, by allowing an internal package to be fetched from the public registry, as well as insecure use of credentials.