tslib icon indicating copy to clipboard operation
tslib copied to clipboard
verified publisher icon microsoft

Enable supply chain security through npm provenance attestation

Open pupapaik opened this issue 1 year ago • 1 comments

  • Configure GitHub Actions workflow for secure publishing
  • Enable automatic provenance generation during npm publish
  • Add integrity verification through Sigstore transparency logs

Following the recent Lottie-Player supply chain attack, it's crucial to enhance package security. NPM provenance provides cryptographic proof that this package was built from this repository using GitHub Actions, making supply chain attacks significantly harder. More info in my blog post https://medium.com/exaforce/npm-provenance-the-missing-security-layer-in-popular-javascript-libraries-b50107927008

pupapaik avatar Nov 14 '24 12:11 pupapaik

any update? does anyone care?

pupapaik avatar Dec 31 '24 09:12 pupapaik