![New request for comments on improving npm security with Sigstore is now open](https://webcf.waybackmachine.org/web/20220818192104im_/https://github.blog/wp-content/uploads/2021/02/npm-github.png?resize=708%2C440)
New request for comments on improving npm security with Sigstore is now open
Supply chain attacks exploit our implicit trust of open source to hurt developers and our customers. Read our proposal for how npm will significantly reduce supply chain attacks by signing packages with Sigstore.