Software Registries Are Becoming Trust Infrastructure, Not Catalogs

Over the past year, package registries—npm, PyPI, RubyGems, crates.io, NuGet—faced a wave of supply chain attacks: the Nx/s1ngularity token theft, the self-replicating Shai-Hulud worm and its 2.0 sequel, the Axios maintainer compromise, and the LiteLLM incident on PyPI. Together these show registries have become strategic infrastructure and prime attack surfaces.

In response, ecosystems converged on nearly identical defenses: OIDC-based trusted publishing, short-lived credentials, provenance attestations, malware scanning, and minimum package age policies. PyPI's quarantine system and crates.io's new security tab illustrate how registries are turning into policy engines rather than simple distribution catalogs.

But trusted publishing only answers whether an artifact came from an authorized pipeline—not whether that pipeline is actually safe. Mini Shai-Hulud demonstrated that compromised CI systems can produce cryptographically valid yet malicious releases. For engineers, the lesson is clear: identity verification is necessary but not sufficient; real supply-chain trust requires scrutiny beyond signatures.