Allow only approved sources in lockfiles

Description

An automated check on every change rejects lockfiles that resolve a package from a host, scheme or source type other than the approved registries.

Rationale

Lockfiles are long and rarely read in review. Swapping a resolved URL to an attacker's host is an easy way to hide a malicious package in an otherwise harmless change.

Impact

The check must be updated when a registry URL changes.

Audit

1. Check that a lockfile source check runs on every change request.
2. Check that it fails on a non-approved host or a non-registry source.

Automated: every check must pass. Scanners report each check by its id.

postmortem

every lockfile source is an approved registry ([harden] registries)

command: postmortem harden --json
control: CB-DEP-LOCK-004
coverage: auto

Remediation

1. Add a check to the pipeline that parses each lockfile and compares every resolved source with the list of approved registries.

References

• Package Manager Best Practices OpenSSF, guide, accessed 2026-10-16
• OWASP Top 10 CI/CD Security Risks OWASP, guide, accessed 2026-10-16

Mappings

How this control relates to the other framework's: equivalent, stricter, looser, partial or related.

Threats mitigated

Related controls

• related CB-DEP-SRC-004 Declare dependencies only from a registry

People and lifecycle