# Mitigating malware in the npm ecosystem with Chainguard Libraries

DevFeed: [Mitigating malware in the npm ecosystem with Chainguard Libraries](<https://devfeed.tech/articles/mitigating-malware-in-the-npm-ecosystem-with-chainguard-libraries-13162.md>)

Original publisher: [Read original article](<https://www.chainguard.dev/unchained/mitigating-malware-in-the-npm-ecosystem-with-chainguard-libraries>)

Published: 2025-10-02T00:00:00Z

Content type: article

Language: en

Sources: [Chainguard: Unchained](<https://devfeed.tech/sources/chainguard-unchained.md>)

Topics: [chainguard libraries](<https://devfeed.tech/topics/chainguard-libraries.md>), [Malware](<https://devfeed.tech/topics/malware.md>), [npm packages](<https://devfeed.tech/topics/npm-packages.md>), [npm](<https://devfeed.tech/topics/npm.md>), [Security](<https://devfeed.tech/topics/security.md>), [GitHub](<https://devfeed.tech/topics/github.md>), [Open Source](<https://devfeed.tech/topics/open-source.md>)

Tags: [chainguard](<https://devfeed.tech/tags/chainguard.md>), [chainguard-ecosystem](<https://devfeed.tech/tags/chainguard-ecosystem.md>), [chainguard-libraries](<https://devfeed.tech/tags/chainguard-libraries.md>), [chainguard-libraries-for-javascript](<https://devfeed.tech/tags/chainguard-libraries-for-javascript.md>), [javascript](<https://devfeed.tech/tags/javascript.md>), [malicious-packages](<https://devfeed.tech/tags/malicious-packages.md>), [malware](<https://devfeed.tech/tags/malware.md>), [npm](<https://devfeed.tech/tags/npm.md>), [npm-malware](<https://devfeed.tech/tags/npm-malware.md>), [npm-package-attack](<https://devfeed.tech/tags/npm-package-attack.md>), [npm-packages](<https://devfeed.tech/tags/npm-packages.md>), [open-source](<https://devfeed.tech/tags/open-source.md>), [security](<https://devfeed.tech/tags/security.md>), [software-supply-chain](<https://devfeed.tech/tags/software-supply-chain.md>)

## AI overview

The article presents research on using Chainguard Libraries for JavaScript to mitigate malware in the npm ecosystem. By requiring attributable source code and validating source-to-artifact integrity through a build-from-source pipeline, the study found that approximately 99% of 8,783 known malicious npm packages would have been prevented from publication, while approximately 99.7% were blocked for users relying on Chainguard Libraries as their sole source of npm dependencies.

## Source excerpt

In a recent analysis, Chainguard Libraries for JavaScript prevented over 99% of malicious npm packages published to the npm registry.