Join us in Minnesota on May 21, 2026 for OpenSSF Community Day!

package security

Catching Malicious Package Releases Using a Transparency Log

Trail of Bits, with funding from OpenSSF, is improving Sigstoreā€™s rekor-monitor to help maintainers detect malicious package releases, monitor signing identities, and strengthen software supply chain security using transparency logs.

Blog Guest Blog attestations ecosystem security identity signing Open Source Security OpenSSF package security rekor sigstore Software Supply Chain Security Trail of Bits transparency logs TUF