Observed arrival · 2026-10-19
keptsec: signed forks for abandoned packages
keptsec describes a service for patching abandoned npm and PyPI packages with open security advisories, then publishing signed forks and their security evidence.
- For
- Teams maintaining software that depends on abandoned npm or PyPI packages
- Worth noticing
- The stated policy is to publish a fork only after upstream is silent for 30 days or the project is archived.
Field notes
The homepage lays out a release gate rather than presenting a catalog of existing packages: each advisory is meant to become a failing test, and a fork ships only if all those tests and the upstream suite pass. It also specifies provenance, signatures, VEX, SBOM, and advisory records as release evidence. The status section says the project has not published a release yet, so these remain a described process rather than demonstrated outputs.
Observed signals
Read the marks
Editorial observations of this landing page, not a rating.
One card from the complete issue