On May 19, 633 malicious npm package versions passed Sigstore provenance verification. They were cleared by the system because the attacker had generated valid signing certificates from a compromised maintainer account.

Sigstore worked exactly as designed: it verified the package was built in a CI environment, confirmed a valid certificate was iss

Key Points

  • On May 19, 633 malicious npm package versions passed Sigstore provenance verification.

  • They were cleared by the system because the attacker had generated valid signing certificates from a compromised maintainer account.

    Sigstore worked exactly as designed: it verified the package was built in a CI environment, confirmed a valid certificate was iss

Stay Informed

This story is actively developing. DigiviNews will continue to provide updates as more information becomes available. Follow us on all social platforms for real-time breaking news coverage in Ai and beyond.