Control of Registries and Package Origin
🌟 Objective
Ensure that all third-party dependencies are obtained from controlled, audited and trusted origins, minimising the risk of attacks via public registries or unverified sources.
⚠️ The simple act of installing a package from a public repository may execute malicious code without any alert. This control is critical.
🔢 Concept of a trusted repository
A repository is considered trusted when it:
- Is internal or proxied, controlled by the organisation
- Allows auditing the history of the packages used
- Implements replication, caching and quarantine policies
- Prevents direct access to external sources without validation
🏠 Technical options for an internal registry
| Technology | Languages / Formats | Main characteristics |
|---|---|---|
| Verdaccio | npm / Yarn (Node.js) | Docker-ready, simple, caching + controlled fallback |
| Sonatype Nexus | Maven, npm, PyPI, Docker | Enterprise-ready, RBAC, auditing and CI integration |
| JFrog Artifactory | Multiple ecosystems | Scalable, retention policies and replicators |
| GitHub Packages | npm, Maven, Container | Integration with GitHub Actions |
🚀 Controlled fallback strategy
- The repository tries to obtain the package locally.
- If it does not exist, it tries an external source under policy validation (domain whitelist or GPG keys).
- The package is cached locally for future builds.
- All accesses are audited and tracked.
This approach drastically reduces exposure to compromised packages.
📝 Configuration recommendations
- Disable external
--registryby default - Provide
.npmrc,.pip.conf,settings.xmlwith a predefined origin - Prohibit installation with
latestor without fixed versioning - Validate package hashes or signatures (where supported)
✅ Additional benefits
- Reproducibility of builds
- Less dependence on external availability (resilience)
- Faster build time with local caching
- Compliance with audit requirements (CRA, NIS2, ISO 27001)
🔗 Links to other files
| Document | Link to origin registries |
|---|---|
06-risco-supply-chain.md | Mitigates typosquatting and downloads of unknown origin |
04-integracao-ci-cd.md | Pipelines must use trusted registries only |
03-governanca-libs-terceiros.md | Defines who approves packages and which ones may be replicated |
🔒 The use of internal repositories with controlled fallback is a structural security measure, not an optional one. It must be part of the baseline of any secure pipeline.