Catching malicious package releases using a transparency log
Summary: Trail of Bits, funded by the OpenSSF, is preparing Sigstore's rekor-monitor for production use, adding support for the new Rekor v2 log, certificate validation against trusted CAs, and public key fetching via The Update Framework. The tool lets package maintainers monitor the append-only, Merkle tree-based Rekor transparency log for new signing events tied to their identity, so an unexpected entry from a compromised release process triggers an alert.
Why it matters: A transparency log only helps if someone watches it: an attacker who releases a malicious package can have its entry added to the log, and without monitoring that entry goes unnoticed, which is why a maintainer's signing identity being used to upload to PyPI can otherwise sit undetected until someone stumbles on the traces.
Read the original at Trail of Bits Blog ↗
- Topics
- Identity & Access Management
- Related
- FBI flash alert says Artex tool automating cyberattacks at ‘machine speed’ Cyber Risks · Nov 13, 2026Connect Wise Cloud Backup application abused in cross-tenant token sweep Cyber Risks · Oct 19, 2026Sponsored: Specter Ops on the impact of AI agents on Blood Hound Cyber Risks · Sep 20, 2026