Block packages known to be malicious

Description

The registry proxy or the pipeline refuses packages and versions listed as malicious in public advisories. A match fails the build and raises an alert. No exception is possible.

Rationale

A malicious package is not a vulnerability to patch later: installing it is already the incident. Advisory databases publish malicious package reports, often within hours.

Impact

None known.

Audit

1. Check that malicious package advisories are part of the scan or proxy policy.
2. Check that a match blocks the install or build and alerts the security team.

Automated: every check must pass. Scanners report each check by its id.

postmortem

a malware gate in CI; --vulns: installed packages with a MAL- advisory

command: postmortem harden --json
control: CB-DEP-VULN-002
coverage: partial

Remediation

1. Enable malicious package advisories in the registry proxy policy and the dependency scan.
2. Treat any match on an existing project as an incident (CB-DEP-IR-001).

References

• Open Source Vulnerability format OpenSSF, standard, accessed 2026-10-16
• Secure Supply Chain Consumption Framework (S2C2F) OpenSSF, guide, accessed 2026-10-16

Mappings

How this control relates to the other framework's: equivalent, stricter, looser, partial or related.

Threats mitigated

Related controls

• related CB-DEP-SRC-001 Resolve all packages through an organization-controlled registry
• related CB-DEP-IR-001 Have a response procedure for compromised dependencies

People and lifecycle