<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: auditing-package-registry-security
description: >-
  Audit package registry configurations, access controls, and security posture.
  Assess npm, PyPI, Maven, and container registries for misconfigurations,
  exposed credentials, overly permissive publishing, and missing MFA enforcement.
domain: cybersecurity
subdomain: supply-chain-security
tags:
  - registry-security
  - npm-security
  - pypi-security
  - artifactory
  - nexus
  - access-control
  - mfa
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: ["T1195.002"]
---

# Auditing Package Registry Security

## Overview

Package registries are high-value targets — a compromised registry means every
downstream consumer is at risk. This skill covers auditing registry access controls,
authentication policies, publishing permissions, MFA enforcement, audit logging,
and network exposure for both public and private registries.

Mode: `[MODE: BLUE]` — Registry hardening audit; `[MODE: RED]` — Registry attack surface assessment.

## Prerequisites

| Requirement | Details |
|---|---|
| npm CLI with admin access to organization | Required |
| pip/twine for PyPI registry interaction | Required |
| Docker CLI for container registry audit | Required |
| curl/jq for REST API queries | Required |
| Access to registry admin panels (Artifactory, Nexus, GitHub Packages) | Required |

## Key Concepts

### npm Organization Audit

```bash
# List organization members and roles
npm org ls <org-name> --json

# Check 2FA enforcement
npm profile get --json | jq '.tfa'

# List packages with publish access
npm access ls-packages <org-name> --json

# Check package publish permissions
npm access ls-collaborators <package-name> --json

# Audit recently published versions
npm view <package-name> time --json | jq 'to_entries | sort_by(.value) | reverse | .[:10]'
```

### Container Registry Audit

```bash
# List repositories in registry
curl -s https://registry.example.com/v2/_catalog | jq '.repositories'

# Check if anonymous pull is enabled
curl -s -o /dev/null -w "%{http_code}" https://registry.example.com/v2/

# List tags for a repository
curl -s https://registry.example.com/v2/<repo>/tags/list | jq '.tags'

# Check image signing
cosign verify --key cosign.pub registry.example.com/app:latest
```

### Artifactory Security Audit

```bash
# Check anonymous access
curl -s -u admin:password https://artifactory.example.com/api/system/configuration | \
  grep -A5 "security"

# List permission targets
curl -s -u admin:password https://artifactory.example.com/api/v2/security/permissions | jq '.'

# Check repository policies
curl -s -u admin:password https://artifactory.example.com/api/repositories | \
  jq '.[] | {key, type, packageType}'
```

## Workflow

### Step 1: Audit Registry Access Controls

```bash
node scripts/agent.js --action audit --registry npm --org my-company --output /tmp/registry-audit.json
```

### Step 2: Check Publishing Permissions

```bash
node scripts/agent.js --action permissions --registry npm --package my-package --output /tmp/perms.json
```

### Step 3: Verify MFA Enforcement

```bash
node scripts/agent.js --action mfa-check --registry npm --org my-company --output /tmp/mfa-report.json
```

## Detection

```yaml
title: Auditing Package Registry Security Detection
id: a34c449c-f9bb-4da9-b870-1ca52d9a8615
status: experimental
description: Detects suspicious activity related to auditing package registry security techniques in supply chain security context
logsource:
  category: process_creation
  product: linux
detection:
  selection:
    CommandLine: "*auditing*package*"
  condition: selection
level: medium
tags:
  - attack.t1195.002
  - attack.initial_access
falsepositives:
  - Package manager performing routine dependency resolution
```


**Detection Opportunities**

| Indicator | Source | Detection Logic |
|---|---|---|
| Auditing Package Registry Security Detection | linux/process_creation | Sigma rule (medium) |
| ATT&CK Coverage | MITRE ATT&CK | T1195.002 |

## Verification

- [ ] MFA enforced for all package publishers
- [ ] Publish permissions follow least privilege (no org-wide write)
- [ ] Anonymous access disabled on private registries
- [ ] Audit logging enabled and forwarded to SIEM
- [ ] Token rotation policy enforced (max 90 days)
- [ ] IP allowlisting configured for publish operations
- [ ] Webhook notifications configured for new package versions

## References

- [npm Security Best Practices](https://docs.npmjs.com/packages-and-modules/securing-your-code)
- [PyPI Trusted Publishers](https://docs.pypi.org/trusted-publishers/)
- [Docker Registry HTTP API](https://docs.docker.com/registry/spec/api/)
- [JFrog Artifactory Security](https://jfrog.com/help/r/jfrog-artifactory-documentation/security)
