Adding 2026 Q2 TAC update for Securing Repos WG #613
There are no files selected for viewing
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,40 @@ | ||
| # 2026 Q2 Securing Software Repositories Working Group | ||
|
|
||
| ## Overview | ||
|
|
||
| Package repositories are under attack. There are several ongoing campaigns that distribute replicating malware via the major package repositories. Previous security capabilities organized by this working group have been helpful, but additional security capabilities are needed to protect open source ecosystems. | ||
|
|
||
| ## Securing Software Repositories Working Group | ||
|
|
||
| ### Purpose | ||
|
|
||
| Improve security of software repositories by providing a forum for discussion, a maturity model for security roadmaps, and guidance for individual security capabilities. These conversations, roadmaps, and guidance help ecosystems learn from each other, which accelerates the deployment of security capabilities. | ||
|
|
||
| ### Current Status | ||
|
|
||
| - Recent attacks on package repositories | ||
| - Mitigating attacks with [npm preview of staged publishing](https://docs.npmjs.com/staged-publishing) | ||
| - Recommend that repositories using trusted publishing disable events from pull_request_target (implemented by npm, PyPI, and Rust Crates) | ||
| - Trusted publishing has been hugely valuable as a signal of suspicious packages, as well as a tool for incident response | ||
| - Welcome to our new co-chair Mike Fiedler; and thanks to former co-chair Dustin Ingram for his years of service | ||
| - We've accepted the Package Analysis and Malicious Packages projects from Securing Critical Projects WG | ||
|
|
||
| ### Up Next | ||
|
|
||
| - [Make npm install scripts opt-in](https://github.com/npm/rfcs/pull/868)? | ||
|
Contributor
There was a problem hiding this comment. What role do you expect the WG to take in this, advising, helping with implementation, etc.?
Member
Author
There was a problem hiding this comment. We would definitely appreciate folks who operate other package repositories to share any relevant experiences and learnings on the RFC. In this particular case, many existing package repositories have avoided making this design decision, but when it's successfully implemented we'll add it to our guidance on https://repos.openssf.org/ for newer / future package repositories to learn from. |
||
|
|
||
| ### Funding requests and updates | ||
|
|
||
| RSTUF is participating in the [summer 2026 LFX Mentorship funding request](https://github.com/ossf/tac/issues/573). | ||
|
|
||
| No other funding request are in progress at this time. | ||
|
|
||
| There are no plans currently to apply for additional funding. | ||
|
|
||
| ### Questions/Issues for the TAC | ||
|
|
||
| None at this time! | ||
|
|
||
| ## Additional Information | ||
|
|
||
| None at this time. | ||
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Could you pls shed some light on what's next for these projects following this transition?
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Our intention is for the projects to continue to operate as they were. There is some maintenance in there, but mostly this involves the Malicious Packages project reviewing and publishing submissions from security researchers. Malicious Packages maintainers have also been proactively notifying operators of package repositories during large-scale campaigns, which we greatly appreciate.
There has been increased security researcher activity since about September of last year, as package managers have seen more frequent and larger scale malware campaigns.