Six Controls for Securing Open-Source Dependencies
Summary
Sonatype outlines six controls for open-source dependencies, from approving sources and evaluating packages before download to monitoring changes in risk and providing clear remediation paths.
Key points
- Route dependency downloads through approved upstream sources and managed repositories across local development and CI/CD.
- Evaluate components before download because some malicious packages can execute code during installation.
- Choose versions based on source, malicious activity, vulnerabilities, licensing, compatibility, and maintenance—not simply on which release is newest.
- Track direct and transitive dependencies; lockfiles help preserve and understand resolved versions but do not replace component evaluation.
- Monitor accepted components for newly disclosed vulnerabilities, identified malware, and discontinued maintenance, and identify affected applications.
- For malicious packages, stop further consumption and investigate possible execution or credential exposure; for vulnerable components, select and test a safer version.
- Sonatype Research says it had logged more than 1.8 million malicious packages across ecosystems over the past decade, as of the end of Q2 2026.
Article Details
- Defense Focus
- Secure open-source dependency consumption from source selection through ongoing monitoring and remediation.
- Detection Methods
- Evaluate packages and specific versions before download, including checks for malicious activity, vulnerabilities, license conflicts, provenance, maintenance, and compatibility.
- Scan components throughout development and continuously monitor direct and transitive dependencies for newly disclosed risks or changes in maintenance status.
- Use dependency inventories and resolution records to identify affected applications and distinguish components in active use from those only downloaded or stored.
- Investigate whether a malicious package executed or exposed credentials.
- Data Sources
- Package source and version information from approved upstream sources and registries
- Dependency inventories, resolved dependency trees, and lockfiles
- Managed repository audit logs of incoming artifacts
- Vulnerability and malware disclosures
- Project and pipeline records showing component usage
- Platforms
- Managed artifact repositories
- Local development environments
- CI/CD pipelines
- Defensive Actions
- Define approved upstream sources and route dependency retrieval through a managed repository across development and CI/CD.
- Block or quarantine suspicious packages before installation; provide a clear alternative or exception process.
- Choose versions based on source, risk, licensing, compatibility, maintenance, and transitive dependencies rather than selecting the newest version by default.
- Track components and versions in applications, including transitive dependencies, and identify affected projects when new intelligence arrives.
- For malicious packages, stop further consumption and investigate execution and possible credential exposure.
- For vulnerable components, identify affected applications, select a safer version, and test compatibility; document, assign, and revisit exceptions when an immediate fix is unavailable.
- Audit dependency pathways for unmanaged downloads and track time to identify affected applications and complete viable upgrades.