OpenSSF publishes a document called "Principles for Package Repository Security" (ossf/wg-securing-software-repos#37) to rate the security of package managers. The list contains a lot of points we should have a look at long-term.

This issue tracks the current state of security.

• Security Capabilities of Package Repositories
  • Level 0
  • Level 1
    • Multi Factor Authentication
    • Vulnerability Reporting (Vulnerability report system #957 feature exists; not released on hex.pm)
  • Level 2
    • requiring MFA for critical packages
    • warning users of known security vulnerabilities (Integrate Vulnerability Database #1276)
  • Level 3
    • MFA for all maintainers
    • supporting build provenance for packages
• Authentication
  • Level 1
    • The package repository requires users to verify their email address.
    • The package repository documents their account recovery policy.
    • The package repository supports strong multi-factor authentication (MFA) via, at minimum, TOTP.
    • The package repository notifies maintainers via email for critical account security changes, such as password changes or disabling multi-factor authentication.
    • The package repository implements account security measures like brute force prevention (even with 2FA attempts)
  • Level 2
    • To prevent domain resurrection for account takeover via the recovery process, the package repository detects abandoned email domains.
    • The package repository supports MFA via phishing-resistant means such as WebAuthn. (WebAuth Proof of Concept #1058)
    • The package repository requires MFA for packages deemed critical
    • The package repository integrates with public leaked credential databases such as Have I Been Pwned
  • Level 3
    • The package repository supports passwordless authentication, such as passkeys. (WebAuth Proof of Concept #1058)
    • The package repository requires MFA for all maintainers.
    • The package repository requires phishing-resistant MFA for packages deemed critical
• Authorization
  • Level 1
    • The package repository allows maintainers to provision API keys scoped to specific packages.
    • API tokens are prefixed with a package repository-specific identifier. (Add hex_-prefixed API key format with GitHub Secret Scanning support #1536)
  • Level 2
    • The package repository supports role-based access control (RBAC) for maintainers, allowing separate roles for managing users and publishing packages.
  • Level 3
    • The package repository provisions short-lived API tokens via an OpenID Connect (OIDC) token exchange (Proposal: Introduce "Trusted Publishers" #1193)
    • The package repository API tokens are integrated into common third-party secret scanning programs. (Add hex_-prefixed API key format with GitHub Secret Scanning support #1536)
    • The package repository supports providing build provenance for packages.
• General Capabilities
  • Level 1
    • The package repository has published a vulnerability disclosure policy - Add SECURITY.md .github#1
    • The package repository takes steps to prevent typosquatting attacks around package names.
  • Level 2
    • The package repository has an unpublish policy to prevent specific versions of a package from being replaced
    • The package repository allows users to report a package as suspicious or malicious
    • The package repository takes steps to detect malware
  • Level 3
    • Undergo periodic security reviews of package repository infrastructure
    • The package repository publishes an event transparency log to enable detection of anomalous behaviors
    • Advisories for malicious packages are published using a standardized machine readable format
• CLI Tooling
  • Level 1
    • The CLI allows installing dependencies that are pinned based on hash, version, etc.
  • Level 2
    • The CLI warns of known security vulnerabilities in dependencies when installing packages (Warn on installation of vulnerable packages hex#1150)
  • Level 3
    • The CLI has functionality to produce SBOMs. (See https://github.com/erlef/mix_sbom)
    • The CLI has functionality to, where possible, automatically remediate known vulnerabilities in dependencies by upgrading them.
    • The package repository is able to reduce false positives of identified vulnerabilities using static analysis to understand whether a vulnerable code path is actually reachable.