# yaml-language-server: $schema=../../../../schema/control.schema.json
id: CB-DEP-LOCK-004
title: Allow only approved sources in lockfiles
finding:
  title: A lockfile change can introduce packages from an unexpected source
status: draft
profiles: [baseline]
risk:
  severity: medium
assessment: partial
tags: [lockfile, review, registry]
description: |
  An automated check on every change rejects lockfiles that resolve a package from a host, scheme or source type other than the approved registries.
rationale: |
  Lockfiles are long and rarely read in review. Swapping a resolved URL to an attacker's host is an easy way to hide a malicious package in an otherwise harmless change.
impact: |
  The check must be updated when a registry URL changes.
audit:
  manual: |
    1. Check that a lockfile source check runs on every change request.
    2. Check that it fails on a non-approved host or a non-registry source.
  checks:
    - id: postmortem
      engine: postmortem
      description: "every lockfile source is an approved registry ([harden] registries)"
      spec:
        command: postmortem harden --json
        control: CB-DEP-LOCK-004
        coverage: auto
remediation:
  manual: |
    1. Add a check to the pipeline that parses each lockfile and compares every resolved source with the list of approved registries.
references:
  - title: Package Manager Best Practices
    url: https://github.com/ossf/package-manager-best-practices
    publisher: OpenSSF
    kind: guide
    accessed: 2026-10-16
  - title: OWASP Top 10 CI/CD Security Risks
    url: https://owasp.org/www-project-top-10-ci-cd-security-risks/
    publisher: OWASP
    kind: guide
    accessed: 2026-10-16
mappings:
  - framework: nist-800-53r5
    framework_version: 5.1.1
    id: SR-3
    relation: related
threats:
  - framework: mitre-attack
    id: T1195.001
related_controls:
  - id: CB-DEP-SRC-004
    type: related
authors:
  - name: Alice
    github: Sn0wAlice
introduced_in: 1.0.0
created: 2026-10-16
updated: 2026-10-16