HighSupply chainBLWK-DEV-006

npm/yarn installs packages without checking TLS certificates (‹path›)

What this means

‹path› turns off certificate checks for the package registry. Anyone on the network path can serve a modified package — whose install script runs on this machine — and read the registry token npm sends.

How to fix it

Remove strict-ssl=false (npm config delete strict-ssl), or enableStrictSsl: false for yarn. Behind a corporate proxy, point npm at its CA instead: npm config set cafile /path/to/proxy-ca.pem

Check it yourself

Run a scan and look for BLWK-DEV-006 in the results:

bulwark scan

Installed the standalone CLI package instead of the app? The command is bulwarkctl.

How Bulwark decides

Bulwark reads dev_tool_config and reports this check when:

kind == "npm" and strict_ssl_off == true

If a value can't be read, Bulwark reports the check as undetermined rather than passing it. View the rule source.

References

• MITRE ATT&CK T1195.001
• MITRE ATT&CK T1557

Related checks

• Git skips TLS certificate checks (‹path›) · BLWK-DEV-001
• Git trusts repositories owned by anyone (‹path›) · BLWK-DEV-002
• Git allows the ext:: transport, which runs commands from a URL (‹path›) · BLWK-DEV-003
• SSH doesn't check server identities (‹path›) · BLWK-DEV-004
• SSH forwards your agent to every server (‹path›) · BLWK-DEV-005
• Packages are installed from a plain-HTTP registry (‹path›) · BLWK-DEV-007