Improve dependency controls — lockfile enforcement, scan-on-PR

The prevention controls for a malicious-dependency incident are layered: lockfile enforcement, scan-on-PR, registry allowlists, and SBOM baseline diff. Each layer catches a compromise path the previous layer did not address. A team that implements one layer is not safe.

The four prevention layers

A permissive resolver is a resolver the attacker can trick. An unscanned PR is a PR the attacker can use. An unrestricted registry is a registry the attacker can substitute:

flowchart LR
    A["compromise prevention"] --> B["lockfile enforcement"]
    A --> C["scan-on-PR"]
    A --> D["registry allowlists"]
    A --> E["SBOM baseline diff"]
    B --> F["no resolver drift"]
    C --> G["no unscanned transitive"]
    D --> H["no registry substitution"]
    E --> I["no undetected transitive"]

• Lockfile enforcement. The install command resolves against the lockfile exactly.
• Scan-on-PR. Every PR runs a vulnerability scan.
• Registry allowlists. The build pulls only from vetted registries.
• SBOM baseline diff. Every build produces an SBOM compared against a baseline.

Lockfile enforcement

A lockfile pins the team’s own resolution; the lockfile does not prevent the registry from serving a different package under the same name and version. The discipline is to use an install command that resolves against the lockfile exactly:

npm ci
pip install --require-hashes -r requirements.lock

npm ci reinstalls from the lockfile exactly; npm install may update the lockfile. The CI command is npm ci; the local development command is npm install.

Scan-on-PR

Every PR that changes a lockfile runs a vulnerability scanner:

npm audit
pip-audit -r requirements.lock
trivy fs --security-checks vuln .

The scan runs as a required check on the PR; a malicious advisory fails the merge.

Registry allowlists

The build is configured to pull only from registries the team controls:

# .npmrc
registry=https://registry.npmjs.org/

# pip.conf
[global]
index-url = https://pypi.org/simple/

The allowlist must be checked into version control and reviewed on every change.

SBOM baseline diff

Every build produces an SBOM; the SBOM is compared against a known-good baseline:

trivy fs --format cyclonedx --output sbom-current.json .
diff sbom-baseline.json sbom-current.json

A divergence is an alert: a new transitive, a version bump, or a removed transitive.

Operational discipline

1. npm ci in CI, never npm install. The lockfile is the source of truth.
2. Scan as a required check. The scan fails the merge.
3. Registry allowlists in version control.
4. SBOM diff on every build. A new transitive is an alert.

Cross-course references

• Git, CI/CD & GitOps — Part LXVII-06 (Package Pinning and Lockfiles) covers the lockfile shape.
• Git, CI/CD & GitOps — Part LXVI-02 (Action and Plugin Pinning) covers the SHA-pinning pattern.
• Container Security for Production Sysadmins — Part V (Image Scanning) covers the registry-side validation patterns.

Quiz