Before adding an R package, check where it comes from, its license and authors, whether it has compiled code, how recently it was updated, and what it depends on. Then record the exact version in a lockfile and scan the result. The whole intake takes about ten minutes.
Why bother
One install.packages call can pull in dozens of packages. Each one runs code on your machine and in your analysis. Registry policy helps, but as covered in what CRAN checks, acceptance is not a security audit.
The seven checks
- Source. Is it from the main repository, a Bioconductor release, or a GitHub URL? A development version on a personal repository has had no registry gate at all. CRAN policy itself says packages should not anticipate or recommend development versions of other packages on other repositories.
- License. CRAN policy requires clear and unambiguous ownership. Read the License field and check it fits your use.
- Authors. Look at the Authors@R field. CRAN prefers it to list all authors and copyright holders, with ORCID identifiers where people have them. A named, traceable team is a better sign than an anonymous one.
- Compiled code. Packages with C, C++ or Fortran carry memory safety risk. CRAN policy bars compiled code that terminates the R process, but that is a behavior rule, not a vulnerability audit.
- Network behavior. Policy asks that packages using the Internet fail gracefully and that security provisions, like certificate checks, are not circumvented. Read the code for downloads at install or load time.
- Update history. When was the last release, and does the maintainer answer issues? Remember that CRAN may archive packages that stop passing checks.
- Dependencies. List what it pulls in. Fewer is better.
Record it
Add the package, then snapshot. The renv lockfile guide shows what gets recorded, and the renv documentation notes that the lockfile stores enough metadata to reinstall every package on a new machine. Commit the lockfile with the project files.
| Check | Where to look |
|---|---|
| License, authors | DESCRIPTION file |
| Compiled code | src directory in the source |
| Dependencies | Imports and Depends fields |
| Update history | NEWS file and release dates |
Try it yourself
Click through it at your own pace, or open it full screen. Look at the transitive dependencies, the ones step seven asks you to find.
Quick check
Is a package from GitHub riskier than one from CRAN?
It passes through no registry gate, so you carry the review yourself. That does not make it unsafe, only less checked.
Where do I record the version I approved?
In the project's lockfile, committed with the code. Add a short note in your lab wiki on why you trusted it.
Safeguard's SBOM and dependency scanning can inventory an R project, and a free scan is available.
Sources
Last reviewed: 19 October 2026.
