# yaml-language-server: $schema=../../../../schema/control.schema.json
id: CB-DEP-AGE-002
title: Wait a minimum age before adopting a new package
finding:
  title: Packages that appeared on the registry days ago can be added as dependencies
status: draft
profiles: [hardened]
risk:
  severity: medium
assessment: partial
tags: [release-age, typosquatting]
description: |
  A package (not a version: the package name itself) that first appeared on its registry less than {{ min_package_age_days }} days ago cannot be added as a new dependency without explicit review.
rationale: |
  Typosquats and fake packages are, by nature, young. A package with no history has no reputation to evaluate. This rule catches what the release-age rule misses: a first release that is malicious from day one and is then left alone.
impact: |
  Brand-new legitimate packages need a review before use.
parameters:
  - name: min_package_age_days
    type: integer
    description: Minimum age of a package, counted from its first published version.
    unit: days
    default: 30
    minimum: 7
    maximum: 365
audit:
  manual: |
    1. Check that new dependency review (CB-DEP-VET-001) or an automated rule flags packages younger than {{ min_package_age_days }} days.
    2. Review recent additions for packages that were young when added.
  checks:
    - id: postmortem
      engine: postmortem
      description: "first-publish date of every package"
      spec:
        command: postmortem harden --json
        control: CB-DEP-AGE-002
        coverage: online
        flags: [--online]
remediation:
  manual: |
    1. Add package age to the new dependency criteria and, where possible, to an automated check on manifest changes.
references:
  - title: Concise Guide for Evaluating Open Source Software
    url: https://best.openssf.org/Concise-Guide-for-Evaluating-Open-Source-Software
    publisher: OpenSSF
    kind: guide
    accessed: 2026-10-16
  - title: Secure Supply Chain Consumption Framework (S2C2F)
    url: https://github.com/ossf/s2c2f
    publisher: OpenSSF
    kind: guide
    accessed: 2026-10-16
mappings:
  - framework: nist-800-53r5
    framework_version: 5.1.1
    id: SR-3
    relation: related
threats:
  - framework: mitre-attack
    id: T1195.001
  - framework: cwe
    id: CWE-1357
related_controls:
  - id: CB-DEP-AGE-001
    type: related
  - id: CB-DEP-VET-002
    type: related
authors:
  - name: Alice
    github: Sn0wAlice
introduced_in: 1.0.0
created: 2026-10-16
updated: 2026-10-16