2026-11-04 –, Lotus Stage 1
Learn about existing measures for software supply chain integrity (Sigstore, SLSA, TUF), their underlying concepts (lockfiles, reproducible builds, hermetic builds, attestations, SBOMs), why they are important, and how to implement these processes in your wallet's software development process.
Wallets are one of the highest-stakes pieces of software in crypto. Yet your wallet probably depends on a few dozen random NPM packages, recursively depending on thousands of others. In the face of NPM package compromises, such as the Axios hack earlier this year, how should wallets protect against software supply chain attacks and make their build processes more robust?
polymutex works on Walletbeat, and wants wallets to actually reflect the cypherpunk ethos of crypto.