npm and Sigstore: Provenance Comes to the World's Largest OSS Ecosystem

At GitHub, we've been hard at work over the last year on a project to secure the Javascript ecosystem by building provenance directly into first-party tooling and partnering with Sigstore to make software signing easy and ubiquitous.

GitHub-owned npm is the de facto standard package system for Javascript, which is the world's largest language ecosystem by lines of code. Serving over 70 billion requests per month and accepting around 40k publish events in the average day, npm is popular enough …

building easy ecosystem github hard javascript npm oss package party project provenance signing sigstore software standard system tooling work world