registry_vulnerability.md

npm

• Packages are published to the OWNER scope
• Unscoped packages can't be published

@OWNER:registry=https://npm.pkg.github.com

https://docs.npmjs.com/about-scopes

NuGet

• Repos can publish packages with any prefix

Whenever a package is submitted to nuget.org with an ID that matches the reserved ID prefix, the package is rejected unless it originates from the owner(s) that reserved the ID prefix.

https://docs.microsoft.com/en-us/nuget/nuget-org/id-prefix-reservation

Docker

• Images are published under an OWNER/REPOSITORY
• Docker image tags are mutable
• Immutable images are pulled using a @DIGEST

docker push docker.pkg.github.com/OWNER/REPOSITORY/IMAGE_NAME:VERSION

Maven

• Maven packages are published under an OWNER/REPOSITORY
• Maven packages are pulled from an OWNER/REPOSITORY
• The REPOSITORY component is ignored when pulling

<url>https://maven.pkg.github.com/OWNER/REPOSITORY</url>

RubyGems

• Gems are published under an owner
• Gems are sourced from a specific repository

source "https://rubygems.org"

gem "rails"

source "https://rubygems.pkg.github.com/OWNER" do
  gem "GEM NAME"
end