---
id: 1312
title: "Catching malicious package releases using a transparency log"
source_domain: blog.trailofbits.com
source_url: "https://blog.trailofbits.com/2025/12/12/catching-malicious-package-releases-using-a-transparency-log/"
published_at: "2025-12-12 12:00"
tags: ["supply-chain", "threat-detection", "sigstore", "rekor", "transparency-log", "tuf", "package-security"]
phying_url: "https://phying.com/item/1312"
lang: en
---

# Catching malicious package releases using a transparency log

## Summary

Trail of Bits is production-hardening Sigstore's rekor-monitor, adding Rekor v2 support and TUF integration so maintainers can detect tampering and unauthorized entries in the transparency log.

## Intelligence Metadata

- **Sources:** blog.trailofbits.com
- **Published:** 2025-12-12 12:00
- **Original:** https://blog.trailofbits.com/2025/12/12/catching-malicious-package-releases-using-a-transparency-log/
- **Phying News:** https://phying.com/item/1312