NPM project contains unused dependencies in an Azure Repos repository

Rule Details

Cortex AppSec Rule ID	APPSEC_CICD_304
Category	Dependency Chains
Severity	LOW

Impact

NPM dependencies can potentially execute code during installation. Each added dependency expands the attack surface. Unused dependencies elevate the risk, as they unnecessarily widen the attack surface of a project without valid justification. An unused and compromised dependency exposes the project to unnecessary risks, potentially allowing malicious code to run on developers' endpoints, during build, or in production.