NEW YORK — What happened
As of September 2026, three major open-source package registries (covering JavaScript, Python, and Rust ecosystems) have begun systematically rejecting updates that lack verifiable build attestations. The shift enforces Supply-chain Levels for Software Artifacts (SLSA) Level 3 and 4 standards, requiring developers to build packages inside isolated, reproducible cloud pipelines.
Why it matters
Software supply chain attacks—where hackers hijack a legitimate developer's credentials or build server to release malicious software updates—have increased significantly over the past five years. Requiring cryptographic attestations ensures that software users can mathematically prove that the file they download matches the source code maintained in public repositories.
Deep dive
Under the new system, packages are built inside temporary, isolated virtual machines managed by trusted continuous integration (CI) providers. Once built, the environment generates an ephemeral cryptographic token signing the artifact. This token proves exactly which git commit generated the binary and which dependencies were imported. Package managers verify this signature before distributing updates to millions of downstream applications.
Report check
Claims: Maintainers claim this update completely eliminates malicious package injections across all open-source software. Verified: Automated build signing prevents compromised developer credentials from uploading malicious builds directly. Still rumor: Claims that legacy, unmaintained packages will be completely removed from registries by the end of the year remain unconfirmed.
Open questions
How will independent maintainers who run self-hosted build servers adapt without relying on major centralized cloud platforms? Will smaller open-source projects collapse under the operational overhead of managing attestation keys?