Keep package manager configuration in the repository

Description

Security-relevant package manager settings (registries, namespace mappings, release age, script execution, frozen installs) are set in configuration files committed with the project, so workstations and pipelines behave the same way.

Rationale

Settings that only live in one person's home folder or one pipeline are lost, drift, and are impossible to review. Committed configuration is versioned and reviewed like code.

Impact

None known. Credentials must still stay out of the repository.

Audit

1. Check that each project has committed package manager configuration covering the settings of this standard.
2. Check that it contains no credentials.

Automated: every check must pass. Scanners report each check by its id.

postmortem

committed package-manager config; security settings only in ~/.npmrc

command: postmortem harden --json
control: CB-DEP-SRC-006
coverage: auto

Remediation

1. Move security-relevant settings into a project configuration file and commit it.
2. Keep tokens in environment variables or a secret store.

References

• Package Manager Best Practices OpenSSF, guide, accessed 2026-10-16

Mappings

How this control relates to the other framework's: equivalent, stricter, looser, partial or related.

Related controls

• related CB-DEP-SRC-001 Resolve all packages through an organization-controlled registry

People and lifecycle