{"id":66435,"date":"2022-08-08T09:22:23","date_gmt":"2022-08-08T16:22:23","guid":{"rendered":"https:\/\/github.blog\/?p=66435"},"modified":"2022-08-23T11:00:39","modified_gmt":"2022-08-23T18:00:39","slug":"new-request-for-comments-on-improving-npm-security-with-sigstore-is-now-open","status":"publish","type":"post","link":"https:\/\/github.blog\/security\/supply-chain-security\/new-request-for-comments-on-improving-npm-security-with-sigstore-is-now-open\/","title":{"rendered":"New request for comments on improving npm security with Sigstore is now open"},"content":{"rendered":"<p>As stewards of the npm registry, we take the security of npm seriously and have continued to introduce a number of changes to improve the security and trustworthiness of the registry. We\u2019ve announced a number of changes over the last several months to improve the security of npm, like <a href=\"https:\/\/github.blog\/2022-05-10-enhanced-2fa-experience-for-your-npm-account\/\">requiring two-factor authentication<\/a>, <a href=\"https:\/\/github.blog\/2022-07-26-introducing-even-more-security-enhancements-to-npm\/\">streamlined login, and enhanced signing of artifacts<\/a>. These changes help protect open source consumers from software supply chain attacks; in other words, when malicious users try to spread malware by breaching a maintainer\u2019s account and adding malicious software to open source dependencies that many developers use.<\/p>\n<p>Today, we\u2019re opening a <a href=\"https:\/\/github.com\/npm\/rfcs\/pull\/626\">new request for comments (RFC)<\/a>, which discusses linking a package with its source repository and its build environment. When package maintainers opt-in to this system, consumers of their packages can have more confidence that the contents of the package match the contents of the linked repository.<\/p>\n<p>Historically, linking packages back to the source code has been difficult because it required individual projects to register and manage their own cryptographic keys. A recent project from the Linux Foundation and Open Source Security Foundation (OpenSSF) called <a href=\"https:\/\/www.sigstore.dev\/\">Sigstore<\/a> has made this process easier and more secure than past methods by not requiring developers to manage long-lived cryptographic keys. The project has seen some early adoption with other package manager <a href=\"https:\/\/github.blog\/2021-12-06-safeguard-container-signing-capability-actions\/\">ecosystems<\/a>. With today\u2019s RFC, we are proposing to add support for end-to-end signing of npm packages using Sigstore. This process would include generating attestations about where, when, and how the package was authored, so that it can be verified later.<\/p>\n<p>Securing the software supply chain is one of the biggest security challenges our industry faces right now. This proposal is an important next step, but truly solving this challenge will require commitment and investment across the community. We\u2019re excited to hear <a href=\"https:\/\/github.com\/npm\/rfcs\/pull\/626\">your feedback<\/a> and look forward to going on this journey together!<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Supply chain attacks exploit our implicit trust of open source to hurt developers and our customers. Read our proposal for how npm will significantly reduce supply chain attacks by signing packages with Sigstore. <\/p>\n","protected":false},"author":1646,"featured_media":56251,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_gh_post_show_toc":"no","_gh_post_is_no_robots":"","_gh_post_is_featured":"no","_gh_post_is_excluded":"no","_gh_post_is_unlisted":"","_gh_post_related_link_1":"","_gh_post_related_link_2":"","_gh_post_related_link_3":"","_gh_post_sq_img":"https:\/\/github.blog\/wp-content\/uploads\/2022\/02\/npm-github_square.png","_gh_post_sq_img_id":"62790","_gh_post_cta_title":"","_gh_post_cta_text":"","_gh_post_cta_link":"","_gh_post_cta_button":"Click Here to Learn More","_gh_post_recirc_hide":"no","_gh_post_recirc_col_1":"gh-auto-select","_gh_post_recirc_col_2":"65301","_gh_post_recirc_col_3":"65308","_gh_post_recirc_col_4":"65316","_featured_video":"","_gh_post_additional_query_params":"","_jetpack_newsletter_access":"","_jetpack_dont_email_post_to_subs":false,"_jetpack_newsletter_tier_id":0,"_jetpack_memberships_contains_paywalled_content":false,"_jetpack_feature_clip_id":0,"_jetpack_memberships_contains_paid_content":false,"footnotes":"","jetpack_publicize_message":"{title}\n\n{excerpt}\n\n{url}","jetpack_publicize_feature_enabled":true,"jetpack_social_post_already_shared":true,"jetpack_social_options":{"image_generator_settings":{"template":"highway","default_image_id":0,"font":"","enabled":false},"version":2},"_wpas_customize_per_network":false,"jetpack_post_was_ever_published":false,"_links_to":"","_links_to_target":""},"categories":[91,3335],"tags":[1640,1709],"coauthors":[2292],"class_list":["post-66435","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-security","category-supply-chain-security","tag-npm","tag-supply-chain-security"],"yoast_head":"<!-- This site is optimized with the Yoast SEO Premium plugin v28.6 (Yoast SEO v28.6) - https:\/\/yoast.com\/product\/yoast-seo-premium-wordpress\/ -->\n<title>New request for comments on improving npm security with Sigstore is now open - The GitHub Blog<\/title>\n<meta name=\"description\" content=\"Supply chain attacks exploit our implicit trust of open source to hurt developers and our customers. Read our proposal for how npm will significantly reduce supply chain attacks by signing packages with Sigstore.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/github.blog\/security\/supply-chain-security\/new-request-for-comments-on-improving-npm-security-with-sigstore-is-now-open\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"New request for comments on improving npm security with Sigstore is now open\" \/>\n<meta property=\"og:description\" content=\"Supply chain attacks exploit our implicit trust of open source to hurt developers and our customers. Read our proposal for how npm will significantly reduce supply chain attacks by signing packages with Sigstore.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/github.blog\/security\/supply-chain-security\/new-request-for-comments-on-improving-npm-security-with-sigstore-is-now-open\/\" \/>\n<meta property=\"og:site_name\" content=\"The GitHub Blog\" \/>\n<meta property=\"article:published_time\" content=\"2022-08-08T16:22:23+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2022-08-23T18:00:39+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/github.blog\/wp-content\/uploads\/2021\/02\/npm-github.png?fit=1200%2C630\" \/>\n\t<meta property=\"og:image:width\" content=\"1200\" \/>\n\t<meta property=\"og:image:height\" content=\"630\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/png\" \/>\n<meta name=\"author\" content=\"Justin Hutchings\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:image\" content=\"https:\/\/github.blog\/wp-content\/uploads\/2021\/02\/npm-github.png?fit=1200%2C630\" \/>\n<meta name=\"twitter:creator\" content=\"@jhutchings0\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Justin Hutchings\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"2 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\\\/\\\/github.blog\\\/security\\\/supply-chain-security\\\/new-request-for-comments-on-improving-npm-security-with-sigstore-is-now-open\\\/#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/github.blog\\\/security\\\/supply-chain-security\\\/new-request-for-comments-on-improving-npm-security-with-sigstore-is-now-open\\\/\"},\"author\":{\"name\":\"Justin Hutchings\",\"@id\":\"https:\\\/\\\/github.blog\\\/#\\\/schema\\\/person\\\/62706a932604181cba95df7791e55719\"},\"headline\":\"New request for comments on improving npm security with Sigstore is now open\",\"datePublished\":\"2022-08-08T16:22:23+00:00\",\"dateModified\":\"2022-08-23T18:00:39+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/github.blog\\\/security\\\/supply-chain-security\\\/new-request-for-comments-on-improving-npm-security-with-sigstore-is-now-open\\\/\"},\"wordCount\":328,\"image\":{\"@id\":\"https:\\\/\\\/github.blog\\\/security\\\/supply-chain-security\\\/new-request-for-comments-on-improving-npm-security-with-sigstore-is-now-open\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/github.blog\\\/wp-content\\\/uploads\\\/2021\\\/02\\\/npm-github.png?fit=1200%2C630\",\"keywords\":[\"npm\",\"supply chain security\"],\"articleSection\":[\"Security\",\"Supply chain security\"],\"inLanguage\":\"en-US\"},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/github.blog\\\/security\\\/supply-chain-security\\\/new-request-for-comments-on-improving-npm-security-with-sigstore-is-now-open\\\/\",\"url\":\"https:\\\/\\\/github.blog\\\/security\\\/supply-chain-security\\\/new-request-for-comments-on-improving-npm-security-with-sigstore-is-now-open\\\/\",\"name\":\"New request for comments on improving npm security with Sigstore is now open - The GitHub Blog\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/github.blog\\\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/github.blog\\\/security\\\/supply-chain-security\\\/new-request-for-comments-on-improving-npm-security-with-sigstore-is-now-open\\\/#primaryimage\"},\"image\":{\"@id\":\"https:\\\/\\\/github.blog\\\/security\\\/supply-chain-security\\\/new-request-for-comments-on-improving-npm-security-with-sigstore-is-now-open\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/github.blog\\\/wp-content\\\/uploads\\\/2021\\\/02\\\/npm-github.png?fit=1200%2C630\",\"datePublished\":\"2022-08-08T16:22:23+00:00\",\"dateModified\":\"2022-08-23T18:00:39+00:00\",\"author\":{\"@id\":\"https:\\\/\\\/github.blog\\\/#\\\/schema\\\/person\\\/62706a932604181cba95df7791e55719\"},\"description\":\"Supply chain attacks exploit our implicit trust of open source to hurt developers and our customers. Read our proposal for how npm will significantly reduce supply chain attacks by signing packages with Sigstore.\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/github.blog\\\/security\\\/supply-chain-security\\\/new-request-for-comments-on-improving-npm-security-with-sigstore-is-now-open\\\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/github.blog\\\/security\\\/supply-chain-security\\\/new-request-for-comments-on-improving-npm-security-with-sigstore-is-now-open\\\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/github.blog\\\/security\\\/supply-chain-security\\\/new-request-for-comments-on-improving-npm-security-with-sigstore-is-now-open\\\/#primaryimage\",\"url\":\"https:\\\/\\\/github.blog\\\/wp-content\\\/uploads\\\/2021\\\/02\\\/npm-github.png?fit=1200%2C630\",\"contentUrl\":\"https:\\\/\\\/github.blog\\\/wp-content\\\/uploads\\\/2021\\\/02\\\/npm-github.png?fit=1200%2C630\",\"width\":1200,\"height\":630},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/github.blog\\\/security\\\/supply-chain-security\\\/new-request-for-comments-on-improving-npm-security-with-sigstore-is-now-open\\\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/github.blog\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Security\",\"item\":\"https:\\\/\\\/github.blog\\\/security\\\/\"},{\"@type\":\"ListItem\",\"position\":3,\"name\":\"Supply chain security\",\"item\":\"https:\\\/\\\/github.blog\\\/security\\\/supply-chain-security\\\/\"},{\"@type\":\"ListItem\",\"position\":4,\"name\":\"New request for comments on improving npm security with Sigstore is now open\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/github.blog\\\/#website\",\"url\":\"https:\\\/\\\/github.blog\\\/\",\"name\":\"The GitHub Blog\",\"description\":\"Updates, ideas, and inspiration from GitHub to help developers build and design software.\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/github.blog\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/github.blog\\\/#\\\/schema\\\/person\\\/62706a932604181cba95df7791e55719\",\"name\":\"Justin Hutchings\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/555336dfbdc2ef5613459d2c746b02185689d6b8a424d568c3467e9f67e6e4cb?s=96&d=mm&r=g60b305c23ca42f980f658006fa2e47e9\",\"url\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/555336dfbdc2ef5613459d2c746b02185689d6b8a424d568c3467e9f67e6e4cb?s=96&d=mm&r=g\",\"contentUrl\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/555336dfbdc2ef5613459d2c746b02185689d6b8a424d568c3467e9f67e6e4cb?s=96&d=mm&r=g\",\"caption\":\"Justin Hutchings\"},\"description\":\"Director of Product Management for supply chain security. I manage the team that's behind Dependabot, the Advisory Database, and the dependency graph. Twitter: https:\\\/\\\/twitter.com\\\/jhutchings0\",\"sameAs\":[\"https:\\\/\\\/x.com\\\/jhutchings0\"],\"url\":\"https:\\\/\\\/github.blog\\\/author\\\/jhutchings1\\\/\"}]}<\/script>\n<!-- \/ Yoast SEO Premium plugin. -->","yoast_head_json":{"title":"New request for comments on improving npm security with Sigstore is now open - The GitHub Blog","description":"Supply chain attacks exploit our implicit trust of open source to hurt developers and our customers. Read our proposal for how npm will significantly reduce supply chain attacks by signing packages with Sigstore.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/github.blog\/security\/supply-chain-security\/new-request-for-comments-on-improving-npm-security-with-sigstore-is-now-open\/","og_locale":"en_US","og_type":"article","og_title":"New request for comments on improving npm security with Sigstore is now open","og_description":"Supply chain attacks exploit our implicit trust of open source to hurt developers and our customers. Read our proposal for how npm will significantly reduce supply chain attacks by signing packages with Sigstore.","og_url":"https:\/\/github.blog\/security\/supply-chain-security\/new-request-for-comments-on-improving-npm-security-with-sigstore-is-now-open\/","og_site_name":"The GitHub Blog","article_published_time":"2022-08-08T16:22:23+00:00","article_modified_time":"2022-08-23T18:00:39+00:00","og_image":[{"width":1200,"height":630,"url":"https:\/\/github.blog\/wp-content\/uploads\/2021\/02\/npm-github.png?fit=1200%2C630","type":"image\/png"}],"author":"Justin Hutchings","twitter_card":"summary_large_image","twitter_image":"https:\/\/github.blog\/wp-content\/uploads\/2021\/02\/npm-github.png?fit=1200%2C630","twitter_creator":"@jhutchings0","twitter_misc":{"Written by":"Justin Hutchings","Est. reading time":"2 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/github.blog\/security\/supply-chain-security\/new-request-for-comments-on-improving-npm-security-with-sigstore-is-now-open\/#article","isPartOf":{"@id":"https:\/\/github.blog\/security\/supply-chain-security\/new-request-for-comments-on-improving-npm-security-with-sigstore-is-now-open\/"},"author":{"name":"Justin Hutchings","@id":"https:\/\/github.blog\/#\/schema\/person\/62706a932604181cba95df7791e55719"},"headline":"New request for comments on improving npm security with Sigstore is now open","datePublished":"2022-08-08T16:22:23+00:00","dateModified":"2022-08-23T18:00:39+00:00","mainEntityOfPage":{"@id":"https:\/\/github.blog\/security\/supply-chain-security\/new-request-for-comments-on-improving-npm-security-with-sigstore-is-now-open\/"},"wordCount":328,"image":{"@id":"https:\/\/github.blog\/security\/supply-chain-security\/new-request-for-comments-on-improving-npm-security-with-sigstore-is-now-open\/#primaryimage"},"thumbnailUrl":"https:\/\/github.blog\/wp-content\/uploads\/2021\/02\/npm-github.png?fit=1200%2C630","keywords":["npm","supply chain security"],"articleSection":["Security","Supply chain security"],"inLanguage":"en-US"},{"@type":"WebPage","@id":"https:\/\/github.blog\/security\/supply-chain-security\/new-request-for-comments-on-improving-npm-security-with-sigstore-is-now-open\/","url":"https:\/\/github.blog\/security\/supply-chain-security\/new-request-for-comments-on-improving-npm-security-with-sigstore-is-now-open\/","name":"New request for comments on improving npm security with Sigstore is now open - The GitHub Blog","isPartOf":{"@id":"https:\/\/github.blog\/#website"},"primaryImageOfPage":{"@id":"https:\/\/github.blog\/security\/supply-chain-security\/new-request-for-comments-on-improving-npm-security-with-sigstore-is-now-open\/#primaryimage"},"image":{"@id":"https:\/\/github.blog\/security\/supply-chain-security\/new-request-for-comments-on-improving-npm-security-with-sigstore-is-now-open\/#primaryimage"},"thumbnailUrl":"https:\/\/github.blog\/wp-content\/uploads\/2021\/02\/npm-github.png?fit=1200%2C630","datePublished":"2022-08-08T16:22:23+00:00","dateModified":"2022-08-23T18:00:39+00:00","author":{"@id":"https:\/\/github.blog\/#\/schema\/person\/62706a932604181cba95df7791e55719"},"description":"Supply chain attacks exploit our implicit trust of open source to hurt developers and our customers. Read our proposal for how npm will significantly reduce supply chain attacks by signing packages with Sigstore.","breadcrumb":{"@id":"https:\/\/github.blog\/security\/supply-chain-security\/new-request-for-comments-on-improving-npm-security-with-sigstore-is-now-open\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/github.blog\/security\/supply-chain-security\/new-request-for-comments-on-improving-npm-security-with-sigstore-is-now-open\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/github.blog\/security\/supply-chain-security\/new-request-for-comments-on-improving-npm-security-with-sigstore-is-now-open\/#primaryimage","url":"https:\/\/github.blog\/wp-content\/uploads\/2021\/02\/npm-github.png?fit=1200%2C630","contentUrl":"https:\/\/github.blog\/wp-content\/uploads\/2021\/02\/npm-github.png?fit=1200%2C630","width":1200,"height":630},{"@type":"BreadcrumbList","@id":"https:\/\/github.blog\/security\/supply-chain-security\/new-request-for-comments-on-improving-npm-security-with-sigstore-is-now-open\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/github.blog\/"},{"@type":"ListItem","position":2,"name":"Security","item":"https:\/\/github.blog\/security\/"},{"@type":"ListItem","position":3,"name":"Supply chain security","item":"https:\/\/github.blog\/security\/supply-chain-security\/"},{"@type":"ListItem","position":4,"name":"New request for comments on improving npm security with Sigstore is now open"}]},{"@type":"WebSite","@id":"https:\/\/github.blog\/#website","url":"https:\/\/github.blog\/","name":"The GitHub Blog","description":"Updates, ideas, and inspiration from GitHub to help developers build and design software.","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/github.blog\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Person","@id":"https:\/\/github.blog\/#\/schema\/person\/62706a932604181cba95df7791e55719","name":"Justin Hutchings","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/secure.gravatar.com\/avatar\/555336dfbdc2ef5613459d2c746b02185689d6b8a424d568c3467e9f67e6e4cb?s=96&d=mm&r=g60b305c23ca42f980f658006fa2e47e9","url":"https:\/\/secure.gravatar.com\/avatar\/555336dfbdc2ef5613459d2c746b02185689d6b8a424d568c3467e9f67e6e4cb?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/555336dfbdc2ef5613459d2c746b02185689d6b8a424d568c3467e9f67e6e4cb?s=96&d=mm&r=g","caption":"Justin Hutchings"},"description":"Director of Product Management for supply chain security. I manage the team that's behind Dependabot, the Advisory Database, and the dependency graph. Twitter: https:\/\/twitter.com\/jhutchings0","sameAs":["https:\/\/x.com\/jhutchings0"],"url":"https:\/\/github.blog\/author\/jhutchings1\/"}]}},"jetpack_publicize_connections":[],"jetpack_shortlink":"https:\/\/wp.me\/pamS32-hhx","jetpack_sharing_enabled":true,"jetpack_featured_media_url":"https:\/\/github.blog\/wp-content\/uploads\/2021\/02\/npm-github.png?fit=1200%2C630","_links":{"self":[{"href":"https:\/\/github.blog\/wp-json\/wp\/v2\/posts\/66435","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/github.blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/github.blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/github.blog\/wp-json\/wp\/v2\/users\/1646"}],"replies":[{"embeddable":true,"href":"https:\/\/github.blog\/wp-json\/wp\/v2\/comments?post=66435"}],"version-history":[{"count":3,"href":"https:\/\/github.blog\/wp-json\/wp\/v2\/posts\/66435\/revisions"}],"predecessor-version":[{"id":66453,"href":"https:\/\/github.blog\/wp-json\/wp\/v2\/posts\/66435\/revisions\/66453"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/github.blog\/wp-json\/wp\/v2\/media\/56251"}],"wp:attachment":[{"href":"https:\/\/github.blog\/wp-json\/wp\/v2\/media?parent=66435"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/github.blog\/wp-json\/wp\/v2\/categories?post=66435"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/github.blog\/wp-json\/wp\/v2\/tags?post=66435"},{"taxonomy":"author","embeddable":true,"href":"https:\/\/github.blog\/wp-json\/wp\/v2\/coauthors?post=66435"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}