Sigstore Fails and Nuro Bets on Being Second Best

Here is the uncomfortable truth about supply chain security: the lock on the front door means nothing if someone steals your keys.

A newly surfaced attack campaign targeting the npm ecosystem managed to slip 633 malicious packages past Sigstore, the cryptographic signing framework that was supposed to be the gold standard for verifying that code actually came from who it claims to come from. The method was almost embarrassingly low-tech — attackers didn't break the cryptography. They just stole developer credentials and used them to publish packages that Sigstore then dutifully signed as legitimate.

This is a significant problem, and not just for the developers whose accounts were compromised. Sigstore's entire value proposition rests on the idea that a verified signature means something. When the identity behind the signature gets hijacked, that assurance collapses entirely. The system worked exactly as designed — it just designed around the wrong threat model.

The npm registry is one of the most consequential pieces of infrastructure in modern software development. With hundreds of billions of package downloads every year, a successful poisoning campaign doesn't just hit one project. It can quietly propagate through dependency chains into applications that have no idea they're running compromised code. The 633 packages discovered in this campaign represent a real-world demonstration of how that attack surface gets exploited.

What makes this particularly thorny for the security community is that Sigstore adoption has been accelerating precisely because organizations wanted a stronger answer to supply chain attacks. High-profile incidents in recent years pushed developers and companies to demand better provenance guarantees. Sigstore was the answer a lot of smart people agreed on. This campaign doesn't invalidate that work, but it does expose a gap between what the technology promises and what it can actually deliver when human accounts are the weakest link.

The attackers appear to have obtained credentials through means that remain under investigation, but the pattern is familiar — phishing, credential stuffing, or reuse of passwords leaked in unrelated breaches. None of that requires sophistication. It just requires patience.

For developers and security teams, the immediate takeaway is practical: cryptographic signing frameworks verify identity at the moment of signing, not the integrity of the identity itself. Layering in hardware security keys, enforcing multi-factor authentication on registry accounts, and auditing published packages for unexpected behavior are no longer optional hygiene. They are prerequisites for trusting any signed artifact.

The broader lesson is harder to swallow. Security tools that shift trust to identity systems are only as strong as those identity systems. Until the industry gets serious about phishing-resistant authentication across every account that touches a software supply chain, campaigns like this one will keep finding the same unlocked window, regardless of how sophisticated the front door gets.

Most companies entering a competitive market try to convince you they are going to beat the leader. Nuro is making the opposite argument — that being second is actually the smart play.

The company, best known for its small autonomous delivery robots, quietly pivoted toward robotaxis in 2024. That pivot came with real firepower: a partnership with Uber and Lucid, ambitions to deploy tens of thousands of vehicles across the US, and hundreds of millions in investment from Uber. Nuro is now targeting a San Francisco launch later this year and has already secured an early permit to make it happen.

The man making the case for strategic lateness is Dave Ferguson, Nuro's cofounder and co-CEO. Ferguson knows Waymo well — he got his start at the original Google self-driving car project, the same one that eventually became Waymo, before leaving in 2016 with cofounder Jiajun Zhu to build Nuro. So when he talks about watching Waymo with respect, he genuinely means it, and he also means it tactically.

The argument is straightforward. Waymo has spent years and enormous resources figuring out how to operate driverless vehicles at scale across multiple cities. Every edge case it has encountered, every operational hiccup that made headlines, every feature that turned out to matter more than expected — all of that is now public knowledge that Nuro's engineers can study and incorporate before they face the same situations themselves. Waymo paid for the education. Nuro plans to take the exam.

Ferguson calls it the classic second-mover perspective, and it is not an unreasonable framework. There is a long history of companies that entered markets after pioneers absorbed the early costs and mistakes — and built more durable businesses because of it. The question is whether Nuro can actually execute, and whether the window stays open long enough.

That is the real risk. Waymo is not standing still. With over 3,000 driverless vehicles operating in at least ten US cities, it is expanding its operational footprint faster than most anticipated. By the time Nuro has meaningful passenger miles under its belt, Waymo will have a data and experience advantage that is difficult to close.

Nuro also has an experience problem of a different kind: it has never carried a single paying passenger. Delivery robots and robotaxis share some underlying technology, but the customer expectations, regulatory requirements, and operational demands are meaningfully different. Ferguson argues the technology transfers cleanly. The market will deliver its own verdict on that.

Still, Nuro has ingredients that matter. An Uber partnership gives it immediate distribution and a user base that Waymo has had to build from scratch. The Lucid angle hints at a vehicle platform that prioritizes passenger experience. And licensing its autonomous driving stack to automakers could create revenue streams that make the economics more forgiving than pure robotaxi operations alone.

Being second does not mean being irrelevant. It just means the margin for error is smaller.