npm Proposes Sigstore-Based Package Signing
GitHub, which stewards the npm registry, has opened a request for comments (RFC) on a proposal to add end-to-end package signing via Sigstore. The goal is to give package consumers a verifiable link between a published package and its source repository and build environment.
The proposal follows a series of security upgrades GitHub has introduced for npm over the past year, including mandatory two-factor authentication for certain accounts, streamlined login flows, and enhanced artifact signing. Those changes were aimed at curbing software supply chain attacks, where a compromised maintainer account is used to inject malicious code into widely used dependencies.
Linking a published package back to its source code has historically been cumbersome because it required projects to generate and manage their own long-lived cryptographic keys. Sigstore, a project from the Linux Foundation and Open Source Security Foundation (OpenSSF), removes that burden by eliminating the need for developers to hold onto long-term keys. The tooling has already seen adoption in other package manager ecosystems, and this RFC would bring the same capability to npm.
Under the proposed system, maintainers who opt in would generate attestations that capture where, when, and how a package was authored. Those attestations could then be verified by consumers, giving them greater confidence that the contents of a package match the contents of the linked repository.
The RFC is open for community feedback now. GitHub frames the proposal as one step in a larger effort, noting that fully addressing software supply chain security will require broad participation across the ecosystem.
