# yaml-language-server: $schema=../../../../schema/control.schema.json
id: CB-DEP-SRC-006
title: Keep package manager configuration in the repository
finding:
  title: Package manager behaviour depends on each machine's local settings
status: draft
profiles: [baseline]
risk:
  severity: low
assessment: partial
tags: [configuration]
description: |
  Security-relevant package manager settings (registries, namespace mappings, release age, script execution, frozen installs) are set in configuration files committed with the project, so workstations and pipelines behave the same way.
rationale: |
  Settings that only live in one person's home folder or one pipeline are lost, drift, and are impossible to review. Committed configuration is versioned and reviewed like code.
impact: |
  None known. Credentials must still stay out of the repository.
audit:
  manual: |
    1. Check that each project has committed package manager configuration covering the settings of this standard.
    2. Check that it contains no credentials.
  checks:
    - id: postmortem
      engine: postmortem
      description: "committed package-manager config; security settings only in ~/.npmrc"
      spec:
        command: postmortem harden --json
        control: CB-DEP-SRC-006
        coverage: auto
remediation:
  manual: |
    1. Move security-relevant settings into a project configuration file and commit it.
    2. Keep tokens in environment variables or a secret store.
references:
  - title: Package Manager Best Practices
    url: https://github.com/ossf/package-manager-best-practices
    publisher: OpenSSF
    kind: guide
    accessed: 2026-10-16
mappings:
  - framework: nist-800-53r5
    framework_version: 5.1.1
    id: CM-2
    relation: related
  - framework: nist-800-53r5
    framework_version: 5.1.1
    id: CM-6
    relation: related
related_controls:
  - id: CB-DEP-SRC-001
    type: related
authors:
  - name: Alice
    github: Sn0wAlice
introduced_in: 1.0.0
created: 2026-10-16
updated: 2026-10-16