AID-H-022.002: Pre-Merge Dependency Change Risk Review

Version 1.20261015 · Actionable sub-technique

Block every pull request or equivalent source-change request that adds or changes a dependency until vulnerability, license, maintainer and repository reputation, release provenance, install-script behavior, and typo or homoglyph checks complete for the declared package, version, source, and lockfile diff. Unsupported or unavailable checks do not pass the change review.

Pillars: infra

Lifecycle: building

Scope boundary

Owns pre-merge review of a proposed dependency change for vulnerability, license, maintainer, repository, release provenance, installer behavior, name confusion, and lockfile impact. A PASS permits only the source change to proceed.

AID-H-003.001: AID-H-022.002 reviews declared change intent and metadata; AID-H-003.001 independently admits the exact resolved bytes and complete dependency population later consumed. Resolution can differ from review time, so pre-merge PASS never authorizes build or deployment.

AID-H-022.001: AID-H-022.002 decides whether the proposed change may merge; AID-H-022.001 safely installs already-approved immutable bytes and proves the resulting consumed layer. Change review and installation containment are sequential controls.

Implementation guidance

AID-H-022.002-G001: Integrate package reputation and behavioral analysis tools into the Pull Request process.

AID-H-022.002-G001

Integrate package reputation and behavioral analysis tools into the Pull Request process.

Concept:

Review every dependency change for known vulnerabilities, license violations, maintainer or repository risk, install-script changes, and typosquatting signals. Dependency Review is a GitHub action; OpenSSF Scorecard is a separate repository and maintainer posture signal.

Key Indicators to Flag

Maintainer churn: an unverified maintainer appears with a new release or install script.
Repository status: the source repository was renamed, archived, transferred, or detached from the package metadata.
Install behavior: a release adds postinstall or another lifecycle script.
Name confusion: the package name resembles an approved dependency through typo or homoglyph substitution.

Run a pinned dependency gate

# File: .github/workflows/dependency-review.yml
name: Dependency Review
on: [pull_request]
jobs:
  dependency-review:
    runs-on: ubuntu-latest
    permissions:
      contents: read
    steps:
      - name: Checkout repository
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
      - name: Dependency review
        uses: actions/dependency-review-action@a1d282b36b6f3519aa1f3fc636f609c47dddb294 # v5.0.0

Required analysis contract

Dependency Review provides vulnerability and license findings plus supporting OpenSSF Scorecard data; it does not prove maintainer churn, install-script behavior, repository transfer, or typosquatting safety. Run an approved package-behavior/reputation analyzer for those signals and normalize its signed output to package URL/version, registry and source repository, release digest, maintainer-change state, lifecycle-script diff, name-confusion result, analyzer/policy versions, complete dependency-change population, and one of PASS/FAIL/INSUFFICIENT_DATA/ERROR. Missing analyzer coverage is INSUFFICIENT_DATA, never a pass; an OpenSSF score alone is supporting evidence, not admission.

Action: Require both the pinned Dependency Review job and the separate package-behavior/reputation decision on dependency-changing pull requests. Pin action SHAs, make both checks required, and retain the dependency diff, exact policy versions, complete analyzer outputs, and merge-gate readback.

Open-source tools

OpenSSF Scorecard
GitHub Dependency Review Action (actions/dependency-review-action; MIT)
Socket CLI (MIT; Socket platform/API dependency)
GuardDog
OSV-Scanner

Commercial / hosted tools

Snyk Advisor
Socket.dev
GitHub Advanced Security

Threat mappings

MITRE ATLAS

AML.T0011 User Execution
AML.T0115 Publish Poisoned AI Artifacts
AML.T0010.005 AI Supply Chain Compromise: AI Agent Tool
AML.T0010 AI Supply Chain Compromise
AML.T0011.001 User Execution: Malicious Package
AML.T0074 Masquerading
AML.T0060 Publish Hallucinated Entities (package vetting detects hallucination-squatted packages)
AML.T0115.002 Publish Poisoned AI Artifacts: AI Agent Tools
AML.T0109 AI Supply Chain Rug Pull
AML.T0111 AI Supply Chain Reputation Inflation

MAESTRO

Supply Chain Attacks (Cross-Layer)
Compromised Framework Components (L3)

OWASP LLM Top 10 2026

LLM04:2026 Supply Chain

OWASP ML Top 10 2023

ML06:2023 AI Supply Chain Attacks

OWASP Top 10 for Agentic Applications 2026

ASI04:2026 Agentic Supply Chain Vulnerabilities

NIST Adversarial Machine Learning 2025

Cisco Integrated AI Security and Safety Framework

AISubtech-9.3.1 Malicious Package / Tool Injection
AISubtech-9.3.2 Dependency Name Squatting (Tools / Servers)
AISubtech-9.3.3 Dependency Replacement / Rug Pull
AITech-9.3 Dependency / Plugin Compromise

Google Secure AI Framework 2.0 - Risks

MST: Model Source Tampering (vetting detects compromised packages before they enter the codebase)
IIC: Insecure Integrated Component (package analysis identifies insecure dependencies)

Databricks AI Security Framework 3.0

Algorithms 5.4: Malicious libraries
Model 7.3: ML Supply chain vulnerabilities
Agents - Tools MCP Server 13.21: Supply Chain Attacks
Agents - Tools MCP Server 13.18: Tool Poisoning