NPM package downloaded from git without commit hash reference in an Azure Repos repository

Rule Details

Cortex AppSec Rule ID	APPSEC_CICD_316
Category	Dependency Chains
Severity	MEDIUM

Impact

NPM packages can be installed using a URL of a git repository, which may contain a reference to a branch, tag or commit hash. Without using a commit hash reference, the integrity of the downloaded package cannot be guaranteed. This can result in developers or build servers downloading a different version of the package than intended, potentially containing malicious code. This could expose both the development and production environments to risks.