Description
The organization owns the namespace, scope or placeholder package names matching its internal packages on each public registry where they could be resolved.
Rationale
A second barrier against dependency confusion, for the day a configuration is wrong or a new project forgets the mapping. It also prevents impersonation of the organization's packages.
Impact
Accounts on public registries must be created and kept secured. Placeholder packages need a clear description so they are not mistaken for real ones.
Audit
- For each internal namespace or prefix, check who owns it on each relevant public registry.
- Confirm the owning accounts belong to the organization and use multi-factor authentication.
Remediation
- Register the namespaces or placeholder names on each relevant public registry.
- Protect the accounts with multi-factor authentication and restrict who can publish.
References
- Secure Supply Chain Consumption Framework (S2C2F) OpenSSF, guide, accessed 2026-10-16
Mappings
| Framework | ID | Relation | Note |
|---|---|---|---|
| NIST SP 800-53 Rev. 55.1.1 | SR-3 | related |
How this control relates to the other framework's: equivalent, stricter, looser, partial or related.
Threats mitigated
| Taxonomy | ID | Note |
|---|---|---|
| MITRE ATT&CK | T1195.001 |
Related controls
- related
CB-DEP-SRC-002Bind internal package namespaces to the private registry
People and lifecycle
| Authors | Alice |
| Introduced in | v1.0.0 |
| Created, updated | 2026-10-16, 2026-10-16 |