HighSupply chainBLWK-DEV-007

Packages are installed from a plain-HTTP registry (‹path›)

What this means

‹path› installs from ‹detail› over unencrypted HTTP. Anyone on the network path can swap in a package that runs its own code at install time, and can read any token sent with the request.

How to fix it

Change the address to https:// (npm config set registry https://…, or index-url / extra-index-url in pip.conf). If the registry has no HTTPS, put it behind a TLS proxy rather than installing over plain HTTP.

Check it yourself

Run a scan and look for BLWK-DEV-007 in the results:

bulwark scan

Installed the standalone CLI package instead of the app? The command is bulwarkctl.

How Bulwark decides

Bulwark reads dev_tool_config and reports this check when:

kind in ["npm", "pip"] and http_registry == true

If a value can't be read, Bulwark reports the check as undetermined rather than passing it. View the rule source.

References

• MITRE ATT&CK T1195.001
• MITRE ATT&CK T1557

Related checks

• Git skips TLS certificate checks (‹path›) · BLWK-DEV-001
• Git trusts repositories owned by anyone (‹path›) · BLWK-DEV-002
• Git allows the ext:: transport, which runs commands from a URL (‹path›) · BLWK-DEV-003
• SSH doesn't check server identities (‹path›) · BLWK-DEV-004
• SSH forwards your agent to every server (‹path›) · BLWK-DEV-005
• npm/yarn installs packages without checking TLS certificates (‹path›) · BLWK-DEV-006