NPM project contains unused dependencies in a GitLab repository

Rule Details

Cortex AppSec Rule ID	APPSEC_CICD_302
Category	Dependency Chains
Severity	LOW

Impact

NPM dependencies can potentially execute code during installation. Each added dependency expands the attack surface. Unused dependencies elevate the risk, as they unnecessarily widen the attack surface of a project without valid justification. An unused and compromised dependency exposes the project to unnecessary risks, potentially allowing malicious code to run on developers' endpoints, during build, or in production.