# yaml-language-server: $schema=../../../../schema/control.schema.json
id: CB-DEP-SRC-003
title: Reserve internal package names on public registries
finding:
  title: Internal package names are free to register on public registries
status: draft
profiles: [hardened]
risk:
  severity: medium
assessment: manual
tags: [dependency-confusion, namespace]
description: |
  The organization owns the namespace, scope or placeholder package names matching its internal packages on each public registry where they could be resolved.
rationale: |
  A second barrier against dependency confusion, for the day a configuration is wrong or a new project forgets the mapping. It also prevents impersonation of the organization's packages.
impact: |
  Accounts on public registries must be created and kept secured. Placeholder packages need a clear description so they are not mistaken for real ones.
audit:
  manual: |
    1. For each internal namespace or prefix, check who owns it on each relevant public registry.
    2. Confirm the owning accounts belong to the organization and use multi-factor authentication.
remediation:
  manual: |
    1. Register the namespaces or placeholder names on each relevant public registry.
    2. Protect the accounts with multi-factor authentication and restrict who can publish.
references:
  - title: Secure Supply Chain Consumption Framework (S2C2F)
    url: https://github.com/ossf/s2c2f
    publisher: OpenSSF
    kind: guide
    accessed: 2026-10-16
mappings:
  - framework: nist-800-53r5
    framework_version: 5.1.1
    id: SR-3
    relation: related
threats:
  - framework: mitre-attack
    id: T1195.001
related_controls:
  - id: CB-DEP-SRC-002
    type: related
authors:
  - name: Alice
    github: Sn0wAlice
introduced_in: 1.0.0
created: 2026-10-16
updated: 2026-10-16