# yaml-language-server: $schema=../../../../schema/control.schema.json
id: CB-DEP-VET-002
title: Evaluate new dependencies against written criteria
finding:
  title: Dependencies are chosen without any trust evaluation
status: draft
profiles: [baseline]
risk:
  severity: medium
assessment: manual
tags: [review, typosquatting, license]
description: |
  Before adoption, a new dependency is checked against written criteria, at least:

  - the name is the intended package, not a look-alike;
  - it links to a public source repository that matches the published content;
  - it is maintained (recent activity, responsive maintainers, security contact);
  - it has a usage and history consistent with its purpose (see CB-DEP-AGE-002);
  - it has no install-time scripts, or they are justified;
  - its license is compatible with the product;
  - its transitive tree is reasonable for what it does;
  - it is needed: the same result is not a few lines of code or already available in the standard library or an existing dependency.
rationale: |
  Most supply chain incidents involve packages that a short look would have flagged: a misspelled name, no source repository, a single anonymous maintainer, or an install hook in a utility library.
impact: |
  A few minutes per new dependency.
audit:
  manual: |
    1. Check that the criteria are written and known to reviewers.
    2. Sample recent additions and check the evaluation was recorded.
remediation:
  manual: |
    1. Write the criteria, starting from the list above.
    2. Add a short evaluation section to the change request template for manifest changes.
references:
  - title: Concise Guide for Evaluating Open Source Software
    url: https://best.openssf.org/Concise-Guide-for-Evaluating-Open-Source-Software
    publisher: OpenSSF
    kind: guide
    accessed: 2026-10-16
  - title: OWASP Software Component Verification Standard
    url: https://owasp.org/www-project-software-component-verification-standard/
    publisher: OWASP
    kind: standard
    accessed: 2026-10-16
mappings:
  - framework: nist-800-53r5
    framework_version: 5.1.1
    id: SR-6
    relation: related
  - framework: nist-800-53r5
    framework_version: 5.1.1
    id: SA-9
    relation: related
threats:
  - framework: mitre-attack
    id: T1195.001
  - framework: cwe
    id: CWE-1357
  - framework: cwe
    id: CWE-1104
related_controls:
  - id: CB-DEP-VET-001
    type: related
  - id: CB-DEP-AGE-002
    type: related
authors:
  - name: Alice
    github: Sn0wAlice
introduced_in: 1.0.0
created: 2026-10-16
updated: 2026-10-16