# npm + Sigstore: Making Javascript secure by default

DevFeed: [npm + Sigstore: Making Javascript secure by default](<https://devfeed.tech/articles/npm-sigstore-making-javascript-secure-by-default-13190.md>)

Original publisher: [Read original article](<https://www.chainguard.dev/unchained/npm-sigstore-making-javascript-secure-by-default>)

Published: 2023-04-19T00:00:00Z

Content type: article

Language: en

Sources: [Chainguard: Unchained](<https://devfeed.tech/sources/chainguard-unchained.md>)

Topics: [npm](<https://devfeed.tech/topics/npm.md>), [sigstore](<https://devfeed.tech/topics/sigstore.md>), [JavaScript](<https://devfeed.tech/topics/javascript.md>), [Security](<https://devfeed.tech/topics/security.md>), [Package manager](<https://devfeed.tech/topics/package-manager.md>)

Tags: [javascript](<https://devfeed.tech/tags/javascript.md>), [npm](<https://devfeed.tech/tags/npm.md>), [provenance](<https://devfeed.tech/tags/provenance.md>), [rekor](<https://devfeed.tech/tags/rekor.md>), [secure-by-default](<https://devfeed.tech/tags/secure-by-default.md>), [signing](<https://devfeed.tech/tags/signing.md>), [sigstore](<https://devfeed.tech/tags/sigstore.md>), [software-supply-chain](<https://devfeed.tech/tags/software-supply-chain.md>), [verification](<https://devfeed.tech/tags/verification.md>)

## AI overview

npm announced a public beta for end-to-end signing of npm packages with Sigstore. The integration lets developers verify package build provenance and records signed attestations in the Rekor transparency log.

## Source excerpt

npm launches Sigstore beta for end-to-end package signing, improving developer trust and security.