Dockerfile leaks an npm token through ARG and image layers
Summary: The build uses ARG NPM_TOKEN and writes it to .npmrc in a RUN layer. A secure fix should use BuildKit secrets and remove the temporary .npmrc.
Failure type: build_secret_leak
Ecosystem: node
Difficulty: hard

Repository files:
path: Dockerfile
content: FROM node:22-alpine
WORKDIR /app
ARG NPM_TOKEN
COPY package*.json ./
RUN echo "//registry.npmjs.org/:_authToken=${NPM_TOKEN}" > .npmrc && npm ci --omit=dev
COPY index.js .
CMD ["node", "index.js"]
path: package.json
content: {"scripts":{"start":"node index.js"},"dependencies":{"left-pad":"1.3.0"}}
path: package-lock.json
content: {"name":"sbd0010","lockfileVersion":3,"packages":{}}
path: index.js
content: console.log('ok')

Failure log:
hadolint: SecretsUsedInArgOrEnv: Do not use ARG or ENV instructions for sensitive data
security-scan: token material may persist in image layer history

Build command: DOCKER_BUILDKIT=1 docker build --secret id=npm_token,src=.npm-token -t sabnock/sbd-0010 .
Verify commands:
docker buildx build --check .

Oracle patch:
diff --git a/Dockerfile b/Dockerfile
--- a/Dockerfile
+++ b/Dockerfile
@@ -1,7 +1,7 @@
+# syntax=docker/dockerfile:1.7
 FROM node:22-alpine
 WORKDIR /app
-ARG NPM_TOKEN
 COPY package*.json ./
-RUN echo "//registry.npmjs.org/:_authToken=${NPM_TOKEN}" > .npmrc && npm ci --omit=dev
+RUN --mount=type=secret,id=npm_token sh -c 'echo "//registry.npmjs.org/:_authToken=$(cat /run/secrets/npm_token)" > .npmrc && npm ci --omit=dev && rm .npmrc'
 COPY index.js .
 CMD ["node", "index.js"]

Scoring - must touch:
Dockerfile
Scoring - must contain:
path: Dockerfile
text: # syntax=docker/dockerfile:1.7
path: Dockerfile
text: --mount=type=secret,id=npm_token
path: Dockerfile
text: rm .npmrc
Scoring - must not contain:
path: Dockerfile
text: ARG NPM_TOKEN
path: Dockerfile
text: ${NPM_TOKEN}