Packages requested by the npm client frequently use external dependencies as defined in the packages' package.json file. These dependencies may, in turn, need additional dependencies. Therefore, when downloading an npm package, you may not have full visibility into the full set of dependencies that your original package needs (whether directly or transitively). As a result, you are at risk of downloading malicious dependencies from unknown external resources.
To manage this risk, and maintain the best practice of consuming external packages through Artifactory, you may specify a "safe" Allow List from which dependencies may be downloaded, cached in Artifactory and configure to rewrite the dependencies so that the npm client accesses dependencies through a virtual repository as follows:
Select the Enable Dependency Rewrite checkboxin the npm virtual repository advanced configuration.
Specify an Allow List pattern of external resources from which dependencies may be downloaded.
Specify the remote repository in which those dependencies should be cached.
It is preferable to configure a dedicated remote repository for that purpose so it is easier to maintain.
In the following example, the external dependencies are cached in the "npm" remote repository and only the package from https://github.com/jfrogdev is allowed to be cached.
Artifactory supports all possible shorthand resolvers including the following:
git+ssh://user@hostname:project.git#commit-ish git+ssh://user@hostname/project.git#commit-ish git+https://git@github.com/<user>/<filename>.git