NPM package downloaded from git without commit hash reference

Rule Details

Cortex AppSec Rule ID	APPSEC_CICD_313
Category	Dependency Chains
Severity	MEDIUM

Impact

NPM packages can be installed using a URL of a git repository, which may contain a reference to a branch, tag or commit hash. Without using a commit hash reference, the integrity of the downloaded package cannot be guaranteed. This can result in developers or build servers downloading a different version of the package than intended, potentially containing malicious code. This could expose both the development and production environments to risks.

Recommended Solution - Buildtime

Pin the package URL:

1. Uninstall the downloaded NPM package: Execute npm uninstall <package>.
2. Reinstall the package with a commit hash reference: Run npm install <github_url>.

   For more information refer to https://docs.npmjs.com/cli/v10/commands/npm-install#description