Have a response procedure for compromised dependencies

Description

A written procedure covers the case where a malicious or compromised package version was installed anywhere in the organization. It includes at least:

1. finding every workstation, pipeline and system that installed it (CB-DEP-INV-002);
2. treating those machines as compromised;
3. rotating every secret they could reach: registry and source hosting tokens, cloud credentials, SSH and signing keys, environment variables;
4. checking whether the organization's own packages or repositories were modified or published with stolen credentials;
5. purging the version from caches and the registry proxy, and pinning a safe version;
6. recording what happened and what changed.

Rationale

Malicious packages typically steal credentials within seconds and use them to spread. The response must be fast and complete, which only happens if it was written before.

Impact

The procedure must be exercised and kept current.

Audit

1. Check that the procedure exists and covers the steps above.
2. Check that it was exercised in the last year.

Remediation

1. Write the procedure, starting from the steps above.
2. Run a tabletop exercise.

References

• NIST SP 800-218 - Secure Software Development Framework (SSDF) 1.1 NIST, standard, accessed 2026-10-16
• Secure Supply Chain Consumption Framework (S2C2F) OpenSSF, guide, accessed 2026-10-16

Mappings

How this control relates to the other framework's: equivalent, stricter, looser, partial or related.

Threats mitigated

Related controls

• related CB-DEP-INV-002 Know where any package version is used within a set time
• related CB-DEP-VULN-002 Block packages known to be malicious

People and lifecycle