# chainguard libraries Published articles for chainguard libraries. This is one page of public article previews, not the complete archive. Follow Next page to continue. Summaries are not the original full articles. ## Chainguard Libraries now available on AWS Security Hub Extended DevFeed: [Chainguard Libraries now available on AWS Security Hub Extended]() Original publisher: [Read original article]() Published: 2026-08-04T00:00:00Z Content type: article Language: en Sources: [Chainguard: Unchained]() Topics: [chainguard libraries](), [AWS Security Hub](), [Security](), [software supply-chain attack](), [Malware](), [Open Source](), [Amazon Web Services]() Tags: [ai-coding](), [aws-security-hub](), [axios](), [chainguard-libraries](), [dependencies](), [java](), [javascript](), [litellm](), [malware](), [mini-shai-hulud](), [npm](), [open-source](), [python](), [redhat](), [redhat-cloud-services](), [security](), [shai-hulud](), [software-supply-chain](), [software-supply-chain-attack](), [telnyx]() ### AI overview Chainguard Libraries is now available through AWS Security Hub Extended's Supply Chain category. The article presents it as a malware-free catalog of Python, Java, and JavaScript dependencies intended to reduce reliance on public registries and help protect AWS workloads from software supply-chain attacks. ### Source excerpt Chainguard Libraries is now available in AWS Security Hub Extended, delivering malware-resistant open source dependencies for AWS workloads. ## Booz Allen Hamilton signs enterprise license agreement with Chainguard DevFeed: [Booz Allen Hamilton signs enterprise license agreement with Chainguard]() Original publisher: [Read original article]() Published: 2026-07-21T00:00:00Z Content type: release Language: en Sources: [Chainguard: Unchained]() Topics: [chainguard containers](), [chainguard libraries](), [open-source-security](), [Security](), [Vulnerabilities](), [Open Source](), [Development]() Tags: [announce](), [ato](), [authority-to-operate](), [booz-allen-hamilton](), [booz-allen-hamilton-engineering](), [booz-chainguard-partnership](), [chainguard](), [chainguard-booz](), [chainguard-containers](), [chainguard-libraries](), [compliance](), [container-images](), [development](), [enterprise](), [government](), [partner](), [secure-by-default](), [security](), [supply-chain](), [trust](), [us](), [vulnerabilities]() ### AI overview Booz Allen Hamilton has signed an enterprise license agreement with Chainguard, giving more than 6,000 engineers access to Chainguard Containers and Chainguard Libraries across U.S. government programs. The agreement is intended to support secure-by-default software delivery, vulnerability remediation, compliance, and software supply chain requirements. ### Source excerpt Booz Allen and Chainguard partner to help 6,000+ engineers deliver secure-by-default software across U.S. government programs. ## AsyncAPI supply chain compromise: npm packages backdoored via GitHub Actions "pwn request" (July 2026) DevFeed: [AsyncAPI supply chain compromise: npm packages backdoored via GitHub Actions "pwn request" (July 2026)]() Original publisher: [Read original article]() Published: 2026-07-14T00:00:00Z Content type: article Language: en Sources: [Chainguard: Unchained]() Topics: [GitHub Actions](), [npm packages](), [AsyncAPI Specification](), [Malware](), [GitHub](), [Remote Access Trojan](), [passwords](), [ssh](), [Cloud](), [Cryptocurrency]() Tags: [asyncapi-supply-chain-attack](), [chainguard-asyncapi](), [chainguard-libraries](), [ci](), [cloud](), [cryptocurrency](), [github](), [github-actions](), [github-actions-pwn-request](), [malicious-packages](), [malware](), [miasma](), [npm](), [npm-packages](), [passwords](), [personal-access-token](), [provenance](), [pull-requests](), [remote-access-trojan](), [ssh](), [supply-chain](), [tokens]() ### AI overview The article analyzes a July 14, 2026 supply-chain compromise in which an attacker stole a privileged GitHub personal access token through a misconfigured GitHub Actions workflow and used it to publish five backdoored versions across four AsyncAPI npm packages. The malware activates when a library is loaded by a build or CI job and steals browser passwords, SSH keys, npm and GitHub tokens, cloud credentials, and cryptocurrency wallets while maintaining command-and-control access. It also explains why Chainguard customers were protected and recommends treating affected environments as compromised and rotating credentials. ### Source excerpt A supply chain attack compromised AsyncAPI npm packages via GitHub Actions. See how Chainguard blocked the malicious releases by design. ## Expanding Athena DevFeed: [Expanding Athena]() Original publisher: [Read original article]() Published: 2026-07-07T00:00:00Z Content type: article Language: en Sources: [Chainguard: Unchained]() Topics: [Vulnerabilities](), [open-source-security](), [Frontier AI](), [AI Models](), [Artificial Intelligence](), [Security](), [Maintainers](), [Parser](), [Library]() Tags: [ai](), [akrites](), [athena](), [chainguard-clearinghouse](), [chainguard-libraries](), [frontier-ai](), [library](), [maintainers](), [open-source](), [parsing](), [secure-open-source](), [secure-oss](), [security](), [vulnerabilities]() ### AI overview Chainguard describes Athena, an industry coalition coordinating the discovery, remediation, protection, disclosure, and upstream fixing of vulnerabilities in open source software. The article reports that Athena has processed more than 40,000 vulnerabilities and emphasizes that frontier AI models can identify latent flaws and chain lower-severity bugs into serious attacks. ### Source excerpt See how Athena is helping secure open source by coordinating AI-discovered vulnerabilities, partner protections, and upstream fixes at scale. ## Why Vulnerability Clearinghouses Alone Cannot Secure Open Source DevFeed: [Why Vulnerability Clearinghouses Alone Cannot Secure Open Source]() Original publisher: [Read original article]() Published: 2026-07-05T00:00:00Z Content type: opinion Language: en Sources: [Chainguard: Unchained]() Topics: [data](), [Vulnerabilities](), [Open Source](), [Security](), [NVD](), [Unix]() Tags: [akrites](), [athena](), [chainguard-libraries](), [data](), [ibm-red-hat-project-lightwell](), [nvd](), [open-source](), [press-release](), [secure-open-source](), [security](), [security-research](), [vulnerability-clearinghouse](), [vulnerability-data]() ### AI overview The article argues that vulnerability clearinghouses are primarily pools of data and are not the most important part of securing open source. It emphasizes actuation--turning findings into fixes--along with trusted builds and secure-by-design software. ### Source excerpt Clearinghouses alone won't secure open source. Learn why actuation, trusted builds, and secure-by-design software matter more than vulnerability data. ## The State of Trusted Open Source: June 2026 DevFeed: [The State of Trusted Open Source: June 2026]() Original publisher: [Read original article]() Published: 2026-06-30T00:00:00Z Content type: article Language: en Sources: [Chainguard: Unchained]() Topics: [Open Source](), [supply-chain-security](), [vulnerability](), [Artificial Intelligence](), [Security]() Tags: [2026](), [ai](), [chainguard](), [chainguard-containers](), [chainguard-libraries](), [cve](), [cve-data](), [cves](), [data](), [dependency](), [java](), [javascript](), [nginx](), [node](), [open-source](), [python](), [report](), [security](), [software](), [software-supply-chain](), [software-supply-chain-security](), [state-of-trusted-open-source](), [trends](), [vulnerability]() ### AI overview Chainguard's June 2026 report analyzes vulnerability data from more than 2,400 container image projects and 18,016 vulnerability instances observed from March through May 2026. It reports 886 distinct CVEs, with 63.1% of observed instances classified as high severity, and examines how AI-assisted development and security research are affecting software supply-chain risk. ### Source excerpt AI is accelerating vulnerability discovery. Explore the latest trusted open source trends, dependency risks, and CVE insights from Chainguard's report. ## Chainguard Repository adds new policies, Chainguard Libraries for JavaScript is GA DevFeed: [Chainguard Repository adds new policies, Chainguard Libraries for JavaScript is GA]() Original publisher: [Read original article]() Published: 2026-06-25T00:00:00Z Content type: release Language: en Sources: [Chainguard: Unchained]() Topics: [chainguard repository](), [chainguard libraries for javascript](), [chainguard](), [JavaScript](), [Malware](), [Artificial Intelligence]() Tags: [ai](), [chainguard](), [chainguard-libraries](), [chainguard-libraries-for-java](), [chainguard-libraries-for-javascript](), [chainguard-libraries-for-python](), [chainguard-repo](), [chainguard-repository](), [javascript](), [libraries](), [malware](), [malware-scanner](), [policy](), [visibility]() ### AI overview Chainguard announces new malware and greyware scanning for additional artifact types, expanded policy controls, and new visibility features in Chainguard Repository. The article also announces general availability of Chainguard Libraries for JavaScript. ### Source excerpt Chainguard Repository adds malware and greyware scanning, expanded policy controls, and visibility to secure AI-driven software supply chains. ## Fewer CVEs, more accurate findings: Wiz now scans Chainguard Libraries for Python and Java DevFeed: [Fewer CVEs, more accurate findings: Wiz now scans Chainguard Libraries for Python and Java]() Original publisher: [Read original article]() Published: 2026-06-25T00:00:00Z Content type: release Language: en Sources: [Chainguard: Unchained]() Topics: [chainguard](), [chainguard libraries](), [chainguard libraries for python](), [Java](), [supply-chain-security](), [Security]() Tags: [chainguard](), [chainguard-libraries](), [chainguard-libraries-for-java](), [chainguard-libraries-for-python](), [cves](), [dependencies](), [java](), [provenance](), [python](), [security](), [software-supply-chain](), [supply-chain](), [wiz](), [wiz-chainguard-libraries](), [wiz-chainguard-scanner]() ### AI overview Wiz now scans Chainguard Libraries for Python and Java. The partnership combines source-built dependencies and backported fixes with Wiz's risk context and visibility, helping organizations assess vulnerabilities, prioritize remediation, and verify artifact provenance. ### Source excerpt Wiz now scans Chainguard Libraries for Python and Java, combining trusted, source-built dependencies with risk-based visibility and remediation. ## Everything we announced during AI Readiness Innovation Week DevFeed: [Everything we announced during AI Readiness Innovation Week]() Original publisher: [Read original article]() Published: 2026-06-25T00:00:00Z Content type: article Language: en Sources: [Chainguard: Unchained]() Topics: [Artificial Intelligence](), [ai-coding](), [supply-chain-security](), [chainguard](), [open-source-security](), [Vulnerabilities](), [Security](), [chainguard libraries](), [chainguard containers](), [CI/CD](), [Frontier AI](), [GitHub]() Tags: [ai](), [ai-readiness](), [athena](), [aws-kiro](), [chainguard](), [chainguard-containers](), [chainguard-libraries](), [ci-cd](), [containers](), [cursor](), [frontier-ai-models](), [gartner-magic-quadrant](), [github](), [innovation](), [open-source](), [security](), [software-supply-chain](), [software-supply-chain-security](), [speed](), [vulnerabilities]() ### AI overview Chainguard summarizes announcements from AI Readiness Innovation Week, covering supply-chain security advances for containers, libraries, CI/CD pipelines, AI agent skills, IDE integrations, partnerships, and an industry coalition. The article highlights Athena, a coalition designed to coordinate defense against vulnerabilities discovered by frontier AI models. ### Source excerpt Read about everything Chainguard announced during AI Readiness Innovation Week, including new features for Chainguard Libraries and Chainguard Containers. ## How Chainguard uses AI agents to enforce engineering standards across a monorepo DevFeed: [How Chainguard uses AI agents to enforce engineering standards across a monorepo]() Original publisher: [Read original article]() Published: 2026-06-24T00:00:00Z Content type: article Language: en Sources: [Chainguard: Unchained]() Topics: [Artificial Intelligence](), [Bot](), [chainguard](), [Pull Request](), [GitHub Actions]() Tags: [agentic](), [agents](), [ai](), [ai-agents](), [chainguard](), [chainguard-agent-skills](), [chainguard-agents](), [chainguard-ai](), [chainguard-containers](), [chainguard-engineering](), [chainguard-libraries](), [ci](), [engineering](), [github](), [policy](), [pull-request](), [workflow]() ### AI overview Chainguard describes a system of specialized AI agents built on DriftlessAF that continuously checks code against machine-readable engineering standards, fixes drift, and supports CI repair. Over eight weeks, it opened more than 4,700 standards-fix pull requests; 75% judged low-risk were auto-merged when AI judgment agreed with deterministic checks. ### Source excerpt Chainguard uses AI-powered agents to continuously enforce engineering standards, remediate drift, and keep codebases aligned at scale. ## Securing the AI coding ecosystem: Chainguard and the AI tools developers use DevFeed: [Securing the AI coding ecosystem: Chainguard and the AI tools developers use]() Original publisher: [Read original article]() Published: 2026-06-24T00:00:00Z Content type: opinion Language: en Sources: [Chainguard: Unchained]() Topics: [chainguard](), [Kiro](), [AI Development](), [cursor](), [Security](), [Containers](), [Open Source]() Tags: [ai](), [ai-agents](), [ai-coding](), [aws-kiro](), [chainguard](), [chainguard-ai-tools](), [chainguard-libraries](), [containers](), [cursor](), [developers](), [kiro](), [open-source](), [secure-by-default]() ### AI overview Chainguard argues that AI coding tools such as Kiro and Cursor need trusted sources for dependencies and container images. The article describes Chainguard Containers, Libraries, and a Kiro plugin intended to move projects from public registries to hardened supply-chain components. ### Source excerpt Chainguard brings secure-by-default containers and libraries to AI coding tools like Kiro and Cursor, making trusted open source the default. ## Chainguard plug-in now available on Cursor Marketplace DevFeed: [Chainguard plug-in now available on Cursor Marketplace]() Original publisher: [Read original article]() Published: 2026-06-24T00:00:00Z Content type: release Language: en Sources: [Chainguard: Unchained]() Topics: [cursor](), [chainguard](), [AI-assisted coding](), [Containers](), [Security]() Tags: [ai-coding-agents](), [chainguard](), [chainguard-containers](), [chainguard-cursor](), [chainguard-cursor-marketplace](), [chainguard-libraries](), [containers](), [cursor](), [cursor-chainguard-containers](), [cursor-chainguard-libraries](), [libraries](), [mcp](), [plugin](), [security]() ### AI overview Chainguard has launched a plugin on the Cursor Marketplace that connects Cursor to Chainguard Containers, Chainguard Libraries, and the Chainguard Repository. The plugin is intended to make secure-by-default artifacts available in AI coding workflows and help agents remediate known vulnerabilities. ### Source excerpt Connect Cursor to Chainguard in minutes and make secure, malware-resistant containers and libraries the default for AI-generated code. ## Chainguard Libraries for Java is now GA; CVE remediation beta available for sign up DevFeed: [Chainguard Libraries for Java is now GA; CVE remediation beta available for sign up]() Original publisher: [Read original article]() Published: 2026-06-23T00:00:00Z Content type: release Language: en Sources: [Chainguard: Unchained]() Topics: [chainguard libraries](), [Java](), [Spring Boot](), [Security](), [Back end]() Tags: [chainguard](), [chainguard-libraries](), [chainguard-libraries-for-java](), [cve](), [cve-remediation](), [dependencies](), [java](), [java-packages](), [java-spring](), [open-source](), [provenance](), [sboms](), [scanner](), [security](), [zero-cve-packages]() ### AI overview Chainguard Libraries for Java is generally available, and its CVE remediation capability is available in beta. The article describes backported fixes for critical and high-severity CVEs across the Spring Boot ecosystem, helping teams manage risks in pinned or legacy Java dependencies while planning upgrades. ### Source excerpt Chainguard Libraries for Java is now GA, delivering CVE-remediated dependencies with SBOMs, provenance, and scanner-recognized fixes. ## Building a category: Chainguard named a Leader in the inaugural Gartner® Magic Quadrant™ for Software Supply Chain Security DevFeed: [Building a category: Chainguard named a Leader in the inaugural Gartner® Magic Quadrant™ for Software Supply Chain Security]() Original publisher: [Read original article]() Published: 2026-06-22T00:00:00Z Content type: article Language: en Sources: [Chainguard: Unchained]() Topics: [supply-chain-security](), [chainguard containers](), [container images](), [Security](), [Containers](), [chainguard libraries]() Tags: [chainguard](), [chainguard-containers](), [chainguard-gartner](), [chainguard-gartner-mq](), [chainguard-libraries](), [container-images](), [gartner](), [gartner-magic-quadrant](), [sboms](), [secure-by-default](), [security](), [software-supply-chain-security](), [software-supply-chain-security-gartner](), [software-supply-chain-security-mq](), [zero-cves]() ### AI overview Chainguard's article discusses its recognition as a Leader in Gartner's inaugural Magic Quadrant for Software Supply Chain Security. It argues that accelerating vulnerability exploitation and AI-assisted development require prevention-oriented, secure-by-default supply chain security. The article highlights Chainguard Containers, which provides minimal container images rebuilt daily from source, with zero CVEs, SBOMs, and verifiable signatures, and briefly introduces Chainguard Libraries. ### Source excerpt Gartner names Chainguard a Leader in Software Supply Chain Security, highlighting its secure-by-default approach and market vision. ## The Maintainer of Last Resort DevFeed: [The Maintainer of Last Resort]() Original publisher: [Read original article]() Published: 2026-06-22T00:00:00Z Content type: opinion Language: en Sources: [Chainguard: Unchained]() Topics: [Open Source](), [Maintainers](), [Vulnerabilities](), [Software](), [Cloud]() Tags: [chainguard-containers](), [chainguard-libraries](), [chainguard-open-source](), [emertioss](), [maintainers](), [open-source](), [open-source-maintainer](), [oss](), [providers](), [software](), [vulnerabilities]() ### AI overview Chainguard proposes a Maintainer of Last Resort as a neutral backstop for abandoned open source projects. The model would fork vulnerable packages, apply fixes, publish verifiable builds, and handle future vulnerability disclosures when upstream maintainers cannot respond in time. ### Source excerpt Chainguard proposes a Maintainer of Last Resort to patch abandoned open source projects, publish trusted builds, and keep critical software secure. ## @mastra npm scope takeover: 143 packages backdoored via compromised contributor account DevFeed: [@mastra npm scope takeover: 143 packages backdoored via compromised contributor account]() Original publisher: [Read original article]() Published: 2026-06-17T00:00:00Z Content type: article Language: en Sources: [Chainguard: Unchained]() Topics: [npm](), [Malware](), [Remote Access Trojan](), [Cryptocurrency](), [C2]() Tags: [c2](), [chainguard-libraries](), [chainguard-packages](), [command-and-control](), [crypto](), [malware](), [mastra](), [npm](), [npm-takeover](), [packages](), [provenance](), [remote-access](), [remote-access-trojan](), [secure-packages](), [software-packages](), [supply-chain](), [tls]() ### AI overview The article reports that an attacker used a compromised former contributor account to republish all 143 packages in the @mastra npm scope on June 17, 2026. The malicious versions could disable TLS verification, download a cryptocurrency wallet stealer and remote access trojan, and establish command-and-control access. It recommends auditing dependency trees and lockfiles and rotating credentials on affected hosts. ### Source excerpt A supply chain attack compromised all 143 @mastra packages. Chainguard customers stayed protected through malware blocking and source-built libraries. ## The expanding threat landscape: Chainguard now scans source code for traditional malware and "greyware" DevFeed: [The expanding threat landscape: Chainguard now scans source code for traditional malware and "greyware"]() Original publisher: [Read original article]() Published: 2026-06-09T00:00:00Z Content type: article Language: en Sources: [Chainguard: Unchained]() Topics: [chainguard](), [Malware](), [Code](), [Open Source](), [npm](), [npm packages](), [Security]() Tags: [chainguard](), [chainguard-libraries](), [ecosystems](), [greyware](), [greyware-scanner](), [hardening](), [javascript](), [malware](), [malware-prevention](), [malware-scanner](), [npm](), [npm-packages](), [open-source](), [packages](), [scanner](), [security](), [source](), [supply-chain-attacks]() ### AI overview Chainguard has introduced a source code scanner that detects traditional malware and "greyware," harmful packages that may perform actions such as credential theft, command interception, API key harvesting, or persistent remote access. The scanner currently protects npm packages, scans more than 100,000 packages daily, and has blocked more than 52,000 packages identified as malware or greyware. ### Source excerpt Chainguard's new scanner blocks malware and 'greyware' before it reaches developers, protecting 100,000+ packages daily across open source ecosystems. ## Miasma Phantom Gyp npm attack: 57 packages, 286 malicious versions hijack CI/CD pipelines via binding.gyp DevFeed: [Miasma Phantom Gyp npm attack: 57 packages, 286 malicious versions hijack CI/CD pipelines via binding.gyp]() Original publisher: [Read original article]() Published: 2026-06-05T00:00:00Z Content type: article Language: en Sources: [Chainguard: Unchained]() Topics: [npm packages](), [Malware](), [Security](), [CI/CD](), [npm](), [chainguard libraries](), [chainguard]() Tags: [chainguard](), [chainguard-actions](), [chainguard-containers](), [chainguard-libraries](), [ci-cd](), [malware](), [miasma](), [npm-security](), [packages](), [phantom-gyp](), [shai-hulud](), [supply-chain]() ### AI overview This article describes the Miasma Phantom Gyp npm supply-chain attack, in which attackers published 286 malicious versions across 57 packages. The self-replicating worm targeted CI/CD pipelines, harvested credentials, poisoned additional packages, modified workflows, and planted backdoor configurations in AI coding assistant directories. It also explains that Chainguard customers were protected because Chainguard Libraries builds from source and blocked the malicious versions. ### Source excerpt A new npm supply chain worm compromised 57 packages and 286 versions. Learn how Chainguard blocked the attack and protected customers by design. ## Chainguard customers safe from Mini Shai-Hulud worm targeting @redhat-cloud-services npm packages with 100K+ weekly downloads DevFeed: [Chainguard customers safe from Mini Shai-Hulud worm targeting @redhat-cloud-services npm packages with 100K+ weekly downloads]() Original publisher: [Read original article]() Published: 2026-06-01T00:00:00Z Content type: news Language: en Sources: [Chainguard: Unchained]() Topics: [npm](), [Security](), [GitHub Actions](), [npm packages](), [GitHub](), [obfuscation](), [payload](), [OpenID connect (OIDC)]() Tags: [chainguard-actions](), [chainguard-libraries](), [endpoint-security](), [github](), [github-actions](), [malware](), [mini-shai-hulud](), [npm](), [obfuscation](), [oidc](), [packages](), [payload](), [red-hat](), [redhat-cloud-services](), [security](), [shai-hulud](), [tokens]() ### AI overview The article reports that the Mini Shai-Hulud worm compromised more than 90 @redhat-cloud-services npm packages through a hijacked GitHub account and GitHub Actions OIDC trusted publishing. The worm spreads tampered packages and malicious workflows, executes an obfuscated payload during installation, and steals cloud, Vault, GitHub, npm, and CI credentials. Chainguard customers using Chainguard Libraries for JavaScript and Chainguard Actions were unaffected. ### Source excerpt A new npm worm hit 90+ Red Hat packages. Chainguard customers stayed protected by blocking install-time scripts and hardening CI/CD workflows. ## Chainguard and Upwind: Secure what you build. Verify what you run. DevFeed: [Chainguard and Upwind: Secure what you build. Verify what you run.]() Original publisher: [Read original article]() Published: 2026-05-26T00:00:00Z Content type: release Language: en Sources: [Chainguard: Unchained]() Topics: [chainguard](), [chainguard libraries](), [supply-chain-security](), [malicious packages](), [Application Security](), [Vulnerabilities]() Tags: [application-security](), [chainguard](), [chainguard-libraries](), [chainguard-libraries-for-python](), [chainguard-scanners](), [chainguard-upwind](), [cybersecurity](), [malicious-packages](), [malware-scanners](), [security](), [supply-chain-attacks](), [upwind](), [vulnerabilities]() ### AI overview Chainguard announces that Upwind now scans Chainguard Libraries for Python. The article describes combining trusted software artifacts with runtime visibility to reduce noise and supply chain risk. ### Source excerpt Chainguard and Upwind combine trusted, source-built artifacts with runtime verification to cut noise, reduce risk, and secure AI-era software. ## Preparing for Mythos: Practical advice for engineering teams DevFeed: [Preparing for Mythos: Practical advice for engineering teams]() Original publisher: [Read original article]() Published: 2026-05-26T00:00:00Z Content type: opinion Language: en Sources: [Chainguard: Unchained]() Topics: [ai security](), [Security](), [anthropic](), [exploit chaining](), [Vulnerabilities](), [open-source-security](), [cURL]() Tags: [advice](), [ai](), [ai-security](), [ai-vulnerability-remediation](), [anthropic](), [article](), [chainguard-containers](), [chainguard-for-ai](), [chainguard-libraries](), [engineering](), [exploit-chaining](), [exploits](), [mythos](), [secure-by-default](), [security](), [vulnerabilities](), [work]() ### AI overview This opinion assesses the security implications of Anthropic's Mythos model and argues that defenders should use AI-assisted methods to identify and remediate vulnerabilities. It says Mythos appears especially capable at exploiting vulnerabilities and chaining exploits, while a test on curl found one new non-critical vulnerability. ### Source excerpt Anthropic's Mythos raises the stakes for software security. Learn how to survive faster exploits with secure-by-default supply chains and AI-assisted defense. ## Mini Shai-Hulud npm Attack: AntV Ecosystem Compromise (May 2026) DevFeed: [Mini Shai-Hulud npm Attack: AntV Ecosystem Compromise (May 2026)]() Original publisher: [Read original article]() Published: 2026-05-19T00:00:00Z Content type: news Language: en Sources: [Chainguard: Unchained]() Topics: [npm packages](), [supply-chain-security](), [Malware](), [Data visualization](), [Aeternum](), [stripe](), [Raycast extension](), [React UI animations]() Tags: [2026](), [antv](), [chainguard-libraries](), [chainguard-npm](), [malware](), [mini-shai-hulud](), [npm](), [npm-malware](), [npm-packages](), [react](), [supply-chain](), [supply-chain-security]() ### AI overview The article reports that a compromised npm maintainer account pushed malicious versions of 314 packages in Alibaba's AntV ecosystem on May 19, 2026. It describes the Mini Shai-Hulud campaign, which uses install hooks and obfuscated Bun scripts to deliver malware and harvest developer credentials. ### Source excerpt The Mini Shai-Hulud npm worm compromised 314 packages in the AntV ecosystem on May 19, 2026 -- including echarts-for-react and timeago.js. ## Building for the AI era: Chainguard partners with Endor Labs DevFeed: [Building for the AI era: Chainguard partners with Endor Labs]() Original publisher: [Read original article]() Published: 2026-05-19T00:00:00Z Content type: article Language: en Sources: [Chainguard: Unchained]() Topics: [supply-chain-security](), [Application Security](), [Artificial Intelligence](), [AI-assisted coding](), [chainguard containers](), [Containers](), [Library](), [Agent Skill](), [CI/CD]() Tags: [agent](), [ai](), [ai-coding-agents](), [application-security](), [chainguard](), [chainguard-containers](), [chainguard-libraries](), [containers](), [cves](), [endor](), [endor-labs](), [observability](), [provenance](), [sboms](), [software-supply-chain](), [vulnerabilities]() ### AI overview Chainguard partners with Endor Labs to help teams building with AI coding agents secure the software supply chain. Chainguard provides source-built artifacts, daily rebuilds, signed SBOMs, and SLSA Level 3 provenance, while Endor Labs analyzes application context to identify vulnerabilities that are genuinely reachable and exploitable. ### Source excerpt Chainguard and Endor Labs help teams build securely at AI speed with source-built artifacts, exploitability analysis, and fewer vulnerabilities to triage. ## Node-ipc compromised: Credential stealer targets package with 500k+ weekly downloads DevFeed: [Node-ipc compromised: Credential stealer targets package with 500k+ weekly downloads]() Original publisher: [Read original article]() Published: 2026-05-14T00:00:00Z Content type: news Language: en Sources: [Chainguard: Unchained]() Topics: [Malware](), [Node.js](), [Security](), [npm](), [Cloud](), [ssh](), [Kubernetes](), [Artificial Intelligence](), [API keys](), [CommonJS](), [Claude](), [Terraform]() Tags: [ai](), [api-keys](), [chainguard-libraries](), [ci-cd](), [claude](), [cloud](), [commonjs](), [dns](), [github](), [kubernetes](), [malware](), [microsoft](), [node](), [node-ipc](), [node-js](), [node-malware](), [node-worm](), [npm](), [npm-malware](), [payload](), [security](), [sha-256](), [shai-hulud](), [ssh](), [terraform]() ### AI overview Three malicious versions of the node-ipc npm package harvested and exfiltrated credentials from cloud providers, SSH, Kubernetes, CI/CD, version-control tools, and AI APIs. The article reports that Chainguard customers were not affected. ### Source excerpt Malicious node-ipc packages stole cloud, SSH, Kubernetes, and AI keys. Chainguard customers stayed protected through source-built libraries. [Next page]()