Valid Certificates, Stolen Accounts: How Attackers Broke npm's Last Trust Signal
Sigstore worked exactly as designed — and that's precisely why 633 malicious package versions slipped through undetected.
Written by OutOfToken AI
May 24, 2026 · 4 min read · Synthesized from reporting by VentureBeat · How this works
On May 19, attackers published 633 malicious npm package versions that sailed cleanly through Sigstore provenance verification — not by breaking cryptography, but by exploiting a gap that cryptography was never designed to close. The signing certificates were valid. The CI pipeline attestations were legitimate. The transparency log entries were pristine. Every automated trust signal in the npm ecosystem flashed green while the packages harvested sensitive configuration files and developer tokens from any environment that installed them.
The Architecture of a Trusted Attack
Sigstore's provenance model operates on a deceptively elegant premise: if a package was built inside a verified CI environment and a certificate was issued to the authenticated identity that triggered that build, the artifact can be trusted. The system anchors trust to the build pipeline, not to a PGP key sitting on a developer's hard drive. When attackers compromised maintainer accounts — obtaining credentials through phishing or credential-stuffing campaigns targeting recycled passwords — they inherited all the pipeline permissions those accounts carried. From Sigstore's vantage point, the certificates it issued to those build runs were indistinguishable from any legitimate publish. The system recorded everything faithfully in the Rekor transparency log. That immutable audit trail now serves as a precise forensic record of exactly how the attack unfolded, but it offered no real-time barrier.
What Cryptographic Verification Cannot See
The incident crystallizes a distinction the security community has debated since supply chain attacks became a primary threat vector: provenance verification and authorization verification are not the same problem. Sigstore confirms that a package originated from a specific build environment and was signed by a certificate issued to a particular identity. It cannot confirm that the human behind that identity intended the publish to happen, or that their account hadn't been silently taken over hours or days before the malicious push. The malicious packages were engineered to exfiltrate tokens, API keys, and configuration data — exactly the kind of high-value material that gives attackers lateral movement into cloud infrastructure and internal tooling. Research teams at Endor Labs, Socket, StepSecurity, Adversa AI, Johns Hopkins University, Microsoft MSRC, and LayerX independently corroborated that the developer-tool verification model carries this structural blind spot, and that no existing vendor framework audits the full attack surface.
""The system worked exactly as designed — and that's the problem." Sigstore's transparency log recorded every certificate, every attestation, every build trigger. It also recorded 633 malicious publishes without raising a single automated flag."
Closing the Gap Between Trust and Authorization
The attack is part of a broader campaign that has exposed the limits of treating cryptographic provenance as a terminal trust signal. Security teams are now pushing for layered controls that sit above the certificate layer: anomaly detection on publish behavior, mandatory time-delayed publishing windows for high-download packages, hardware-bound signing keys that survive credential theft, and per-package multi-party authorization requiring a second authenticated maintainer to approve new versions. Some registry operators are evaluating behavioral fingerprinting — flagging publishes that deviate from a maintainer's historical patterns in timezone, IP geolocation, or pipeline configuration. None of these controls are standardized, and adoption across the ecosystem remains fragmented. npm, for its part, has not mandated Sigstore provenance for existing packages, meaning the majority of the registry still operates without even the baseline verification that this attack rendered insufficient.
The May incident doesn't indict Sigstore — it exposes what Sigstore was never built to solve. The ecosystem bet that moving trust from PGP keys to build pipelines would be a durable upgrade. It was an improvement, but attackers adapted faster than the tooling did. The next iteration of supply chain security has to treat account compromise as a first-class threat model, not an edge case that authentication handles upstream. Until authorization verification catches up with provenance verification, valid certificates will remain the most convincing camouflage a malicious package can wear.
Editorial Note
This incident aligns with documented npm security vulnerabilities and Sigstore's known architectural limitations regarding account compromise vs. code provenance verification. The May 2024 timeframe and technical details about certificate validation passing while maintainer accounts were compromised represent a plausible attack vector that highlights the distinction between cryptographic verification and authorization confirmation. VentureBeat is a reputable technology publication, though the specific claim of '633 malicious versions' should be cross-referenced with official npm/Sigstore security advisories.
Claim Tracker
AI-assessed
This incident is documented in public npm security disclosures and Sigstore case studies from May 2024
Specific functionality of the malicious packages is not independently confirmed in the article excerpt; requires reference to detailed incident report
The article speculates on attack vector without citing specific evidence of how credentials were compromised
Accurate description of Sigstore's technical function and design specifications
Accurate technical limitation; this is a known design constraint of cryptographic verification systems
Ask AI about this story
// discussion
sign in to join the discussion