title: Maven dependencies restrict to private repositories
body: <p>We have a corporate/private maven registry (&quot;artifactory&quot;) in place, which is used by our projects to resolve the project's dependencies.</p>
  <p>This private maven registry also proxies Maven Central for common dependencies, meaning dependencies that were not resolved by the internal registry in the first place.</p>
  <p>We want to avoid supply-chain attacks, namely someone overloading a custom dependency we use in our private/corporate maven registry with the same identifiers in Maven Central.
  Say, i.e. publishing a malicious dependency artifact in Maven Central with the same <code>groupId</code> and <code>artifactId</code> as the internal one, but with a higher <code>version</code> - that one would then take precedence and wreak havoc in our systems.</p>
  <p>In npm, there is a mechanism that allows &quot;tagging&quot; a dependency to a certain private registry (via <code>scope</code>).</p>
  <p>Is there a similar mechanism in Maven that allows certain dependencies to only resolve from the internal artifactory, and prevent it from being resolved from Maven Central?</p>
  <p>I am thinking of something like <code>artifactory</code>:</p>
  <pre><code>&lt;dependency&gt;
    &lt;groupId&gt;org.acme&lt;/groupId&gt;
    &lt;artifactId&gt;supersecret&lt;/artifactId&gt;
    &lt;version&gt;3.141&lt;/version&gt;
    &lt;artifactory&gt;internal_corporate_artifactory_name&lt;/artifactory&gt; &lt;!-- as described in settings.xml or Super-Pom --&gt;
  &lt;/dependency&gt;
  </code></pre>