Valid certificates, stolen accounts: how attackers broke npm's last trust signal (opens in new tab)

On May 19, 633 malicious npm package versions . They were cleared by the system because the attacker had generated valid signing certificates from a compromised maintainer account.Sigstore worked exactly as designed: it verified the package was built in a CI environment, confirmed a valid certificate was issued, and recorded everything in the transparency log. What it cannot do is determine whether the person holding the credentials authorized the publish — and that gap turned the last automa...