Bind internal package namespaces to the private registry

Description

Internal packages use a dedicated namespace, scope or prefix. The package manager is configured so that this namespace is only ever resolved from the private registry, never from a public one, and the registry proxy does not fall back to public sources for it.

Ecosystems differ: some have native scopes or namespaces, others only allow one index or need explicit per-package source mapping. Where no reliable mapping exists, use a single private registry that serves internal packages and proxies public ones without name overlap.

Rationale

When a package manager searches several registries for the same name, it may pick the public one, often because it has a higher version number. This lets anyone on the internet inject code into internal builds by guessing or leaking an internal package name.

Impact

Existing internal packages without a namespace must be renamed or explicitly mapped, which touches every project that uses them.

Audit

1. List internal packages and the namespace or prefix they use.
2. For each ecosystem, check that this namespace is mapped to the private registry only.
3. Check the registry proxy: a request for an internal name must never be forwarded upstream.

Automated: every check must pass. Scanners report each check by its id.

postmortem

npm scope→registry mappings, pip --extra-index-url, uv unsafe index strategies

command: postmortem harden --json
control: CB-DEP-SRC-002
coverage: auto

Remediation

1. Choose a namespace or prefix for internal packages and move them under it.
2. Map the namespace to the private registry in versioned configuration.
3. Disable upstream fallback for that namespace in the registry proxy.

References

• Secure Supply Chain Consumption Framework (S2C2F) OpenSSF, guide, accessed 2026-10-16
• Package Manager Best Practices OpenSSF, guide, accessed 2026-10-16

Mappings

How this control relates to the other framework's: equivalent, stricter, looser, partial or related.

Threats mitigated

Related controls

• related CB-DEP-SRC-001 Resolve all packages through an organization-controlled registry
• related CB-DEP-SRC-003 Reserve internal package names on public registries

People and lifecycle