NPM project contains unused dependencies

Rule Details

Cortex AppSec Rule ID	APPSEC_CICD_301
Category	Dependency Chains
Severity	LOW

Impact

NPM dependencies can potentially execute code during installation. Each added dependency expands the attack surface. Unused dependencies elevate the risk, as they unnecessarily widen the attack surface of a project without valid justification. An unused and compromised dependency exposes the project to unnecessary risks, potentially allowing malicious code to run on developers' endpoints, during build, or in production.

Recommended Solution - Buildtime

It is recommended to remove unused dependencies from a project: Run npm uninstall <package_name>.