# yaml-language-server: $schema=../../../../schema/control.schema.json
id: CB-DEP-EXEC-001
title: Block install-time scripts except for an allowlist
finding:
  title: Any dependency can run code when it is installed
  description: Install hooks run with the user's or the pipeline's privileges, before any test or review, and are the most common way malicious packages steal credentials.
status: draft
profiles: [baseline]
risk:
  severity: high
assessment: partial
tags: [install-scripts, malware]
description: |
  Package lifecycle scripts that run at install time (pre-install, post-install, build hooks) are disabled by default. Only packages on an explicit, reviewed allowlist may run them.
rationale: |
  Most malicious packages do their work in an install hook: they steal tokens and keys from the environment the moment the package is installed, without ever being imported by the application.
impact: |
  Packages that compile native code or download binaries at install time break until they are added to the allowlist or replaced.
audit:
  manual: |
    1. Check that install-time scripts are disabled in committed package manager configuration.
    2. Review the allowlist: each entry must have a reason.
    3. Check that pipelines do not re-enable scripts with a flag.
  checks:
    - id: postmortem
      engine: postmortem
      description: "script policy of npm, pnpm, yarn, bun and composer plugins"
      spec:
        command: postmortem harden --json
        control: CB-DEP-EXEC-001
        coverage: auto
remediation:
  manual: |
    1. Disable install-time scripts in committed configuration.
    2. Run an install, list the packages whose scripts were skipped, and allowlist only those needed.
references:
  - title: Package Manager Best Practices
    url: https://github.com/ossf/package-manager-best-practices
    publisher: OpenSSF
    kind: guide
    accessed: 2026-10-16
  - title: Secure Supply Chain Consumption Framework (S2C2F)
    url: https://github.com/ossf/s2c2f
    publisher: OpenSSF
    kind: guide
    accessed: 2026-10-16
mappings:
  - framework: nist-800-53r5
    framework_version: 5.1.1
    id: CM-7
    relation: related
  - framework: nist-800-53r5
    framework_version: 5.1.1
    id: SR-11
    relation: related
threats:
  - framework: mitre-attack
    id: T1195.001
  - framework: mitre-attack
    id: T1059
  - framework: cwe
    id: CWE-829
related_controls:
  - id: CB-DEP-EXEC-002
    type: related
  - id: CB-DEP-CI-001
    type: related
authors:
  - name: Alice
    github: Sn0wAlice
introduced_in: 1.0.0
created: 2026-10-16
updated: 2026-10-16