# yaml-language-server: $schema=../../../../schema/control.schema.json
id: CB-DEP-VULN-002
title: Block packages known to be malicious
finding:
  title: Packages flagged as malicious can still be installed
status: draft
profiles: [baseline]
risk:
  severity: critical
assessment: partial
tags: [malware, registry]
description: |
  The registry proxy or the pipeline refuses packages and versions listed as malicious in public advisories. A match fails the build and raises an alert. No exception is possible.
rationale: |
  A malicious package is not a vulnerability to patch later: installing it is already the incident. Advisory databases publish malicious package reports, often within hours.
impact: |
  None known.
audit:
  manual: |
    1. Check that malicious package advisories are part of the scan or proxy policy.
    2. Check that a match blocks the install or build and alerts the security team.
  checks:
    - id: postmortem
      engine: postmortem
      description: "a malware gate in CI; --vulns: installed packages with a MAL- advisory"
      spec:
        command: postmortem harden --json
        control: CB-DEP-VULN-002
        coverage: partial
remediation:
  manual: |
    1. Enable malicious package advisories in the registry proxy policy and the dependency scan.
    2. Treat any match on an existing project as an incident (CB-DEP-IR-001).
references:
  - title: Open Source Vulnerability format
    url: https://ossf.github.io/osv-schema/
    publisher: OpenSSF
    kind: standard
    accessed: 2026-10-16
  - title: Secure Supply Chain Consumption Framework (S2C2F)
    url: https://github.com/ossf/s2c2f
    publisher: OpenSSF
    kind: guide
    accessed: 2026-10-16
mappings:
  - framework: nist-800-53r5
    framework_version: 5.1.1
    id: SI-3
    relation: related
  - framework: nist-800-53r5
    framework_version: 5.1.1
    id: SR-11
    relation: related
threats:
  - framework: mitre-attack
    id: T1195.001
  - framework: cwe
    id: CWE-506
related_controls:
  - id: CB-DEP-SRC-001
    type: related
  - id: CB-DEP-IR-001
    type: related
authors:
  - name: Alice
    github: Sn0wAlice
introduced_in: 1.0.0
created: 2026-10-16
updated: 2026-10-16