# chainguard libraries for python

Published articles for chainguard libraries for python.

This is one page of public article previews, not the complete archive. Follow Next page to continue. Summaries are not the original full articles.

## Chainguard Repository adds new policies, Chainguard Libraries for JavaScript is GA

DevFeed: [Chainguard Repository adds new policies, Chainguard Libraries for JavaScript is GA](<https://devfeed.tech/articles/chainguard-repository-adds-new-policies-chainguard-libraries-for-javascript-is-ga-12979.md>)

Original publisher: [Read original article](<https://www.chainguard.dev/unchained/chainguard-repository-adds-new-policies-chainguard-libraries-for-javascript-is-ga>)

Published: 2026-06-25T00:00:00Z

Content type: release

Language: en

Sources: [Chainguard: Unchained](<https://devfeed.tech/sources/chainguard-unchained.md>)

Topics: [chainguard repository](<https://devfeed.tech/topics/chainguard-repository.md>), [chainguard libraries for javascript](<https://devfeed.tech/topics/chainguard-libraries-for-javascript.md>), [chainguard](<https://devfeed.tech/topics/chainguard.md>), [JavaScript](<https://devfeed.tech/topics/javascript.md>), [Malware](<https://devfeed.tech/topics/malware.md>), [Artificial Intelligence](<https://devfeed.tech/topics/ai.md>)

Tags: [ai](<https://devfeed.tech/tags/ai.md>), [chainguard](<https://devfeed.tech/tags/chainguard.md>), [chainguard-libraries](<https://devfeed.tech/tags/chainguard-libraries.md>), [chainguard-libraries-for-java](<https://devfeed.tech/tags/chainguard-libraries-for-java.md>), [chainguard-libraries-for-javascript](<https://devfeed.tech/tags/chainguard-libraries-for-javascript.md>), [chainguard-libraries-for-python](<https://devfeed.tech/tags/chainguard-libraries-for-python.md>), [chainguard-repo](<https://devfeed.tech/tags/chainguard-repo.md>), [chainguard-repository](<https://devfeed.tech/tags/chainguard-repository.md>), [javascript](<https://devfeed.tech/tags/javascript.md>), [libraries](<https://devfeed.tech/tags/libraries.md>), [malware](<https://devfeed.tech/tags/malware.md>), [malware-scanner](<https://devfeed.tech/tags/malware-scanner.md>), [policy](<https://devfeed.tech/tags/policy.md>), [visibility](<https://devfeed.tech/tags/visibility.md>)

### AI overview

Chainguard announces new malware and greyware scanning for additional artifact types, expanded policy controls, and new visibility features in Chainguard Repository. The article also announces general availability of Chainguard Libraries for JavaScript.

### Source excerpt

Chainguard Repository adds malware and greyware scanning, expanded policy controls, and visibility to secure AI-driven software supply chains.

## Fewer CVEs, more accurate findings: Wiz now scans Chainguard Libraries for Python and Java

DevFeed: [Fewer CVEs, more accurate findings: Wiz now scans Chainguard Libraries for Python and Java](<https://devfeed.tech/articles/fewer-cves-more-accurate-findings-wiz-now-scans-chainguard-libraries-for-python-and-java-13335.md>)

Original publisher: [Read original article](<https://www.chainguard.dev/unchained/wiz-now-scans-chainguard-libraries-for-python-and-java>)

Published: 2026-06-25T00:00:00Z

Content type: release

Language: en

Sources: [Chainguard: Unchained](<https://devfeed.tech/sources/chainguard-unchained.md>)

Topics: [chainguard](<https://devfeed.tech/topics/chainguard.md>), [chainguard libraries](<https://devfeed.tech/topics/chainguard-libraries.md>), [chainguard libraries for python](<https://devfeed.tech/topics/chainguard-libraries-for-python.md>), [Java](<https://devfeed.tech/topics/java.md>), [supply-chain-security](<https://devfeed.tech/topics/supply-chain-security.md>), [Security](<https://devfeed.tech/topics/security.md>)

Tags: [chainguard](<https://devfeed.tech/tags/chainguard.md>), [chainguard-libraries](<https://devfeed.tech/tags/chainguard-libraries.md>), [chainguard-libraries-for-java](<https://devfeed.tech/tags/chainguard-libraries-for-java.md>), [chainguard-libraries-for-python](<https://devfeed.tech/tags/chainguard-libraries-for-python.md>), [cves](<https://devfeed.tech/tags/cves.md>), [dependencies](<https://devfeed.tech/tags/dependencies.md>), [java](<https://devfeed.tech/tags/java.md>), [provenance](<https://devfeed.tech/tags/provenance.md>), [python](<https://devfeed.tech/tags/python.md>), [security](<https://devfeed.tech/tags/security.md>), [software-supply-chain](<https://devfeed.tech/tags/software-supply-chain.md>), [supply-chain](<https://devfeed.tech/tags/supply-chain.md>), [wiz](<https://devfeed.tech/tags/wiz.md>), [wiz-chainguard-libraries](<https://devfeed.tech/tags/wiz-chainguard-libraries.md>), [wiz-chainguard-scanner](<https://devfeed.tech/tags/wiz-chainguard-scanner.md>)

### AI overview

Wiz now scans Chainguard Libraries for Python and Java. The partnership combines source-built dependencies and backported fixes with Wiz's risk context and visibility, helping organizations assess vulnerabilities, prioritize remediation, and verify artifact provenance.

### Source excerpt

Wiz now scans Chainguard Libraries for Python and Java, combining trusted, source-built dependencies with risk-based visibility and remediation.

## Chainguard and Upwind: Secure what you build. Verify what you run.

DevFeed: [Chainguard and Upwind: Secure what you build. Verify what you run.](<https://devfeed.tech/articles/chainguard-and-upwind-secure-what-you-build-verify-what-you-run-12926.md>)

Original publisher: [Read original article](<https://www.chainguard.dev/unchained/chainguard-and-upwind-secure-what-you-build-verify-what-you-run>)

Published: 2026-05-26T00:00:00Z

Content type: release

Language: en

Sources: [Chainguard: Unchained](<https://devfeed.tech/sources/chainguard-unchained.md>)

Topics: [chainguard](<https://devfeed.tech/topics/chainguard.md>), [chainguard libraries](<https://devfeed.tech/topics/chainguard-libraries.md>), [supply-chain-security](<https://devfeed.tech/topics/supply-chain-security.md>), [malicious packages](<https://devfeed.tech/topics/malicious-packages.md>), [Application Security](<https://devfeed.tech/topics/application-security.md>), [Vulnerabilities](<https://devfeed.tech/topics/vulnerabilities.md>)

Tags: [application-security](<https://devfeed.tech/tags/application-security.md>), [chainguard](<https://devfeed.tech/tags/chainguard.md>), [chainguard-libraries](<https://devfeed.tech/tags/chainguard-libraries.md>), [chainguard-libraries-for-python](<https://devfeed.tech/tags/chainguard-libraries-for-python.md>), [chainguard-scanners](<https://devfeed.tech/tags/chainguard-scanners.md>), [chainguard-upwind](<https://devfeed.tech/tags/chainguard-upwind.md>), [cybersecurity](<https://devfeed.tech/tags/cybersecurity.md>), [malicious-packages](<https://devfeed.tech/tags/malicious-packages.md>), [malware-scanners](<https://devfeed.tech/tags/malware-scanners.md>), [security](<https://devfeed.tech/tags/security.md>), [supply-chain-attacks](<https://devfeed.tech/tags/supply-chain-attacks.md>), [upwind](<https://devfeed.tech/tags/upwind.md>), [vulnerabilities](<https://devfeed.tech/tags/vulnerabilities.md>)

### AI overview

Chainguard announces that Upwind now scans Chainguard Libraries for Python. The article describes combining trusted software artifacts with runtime visibility to reduce noise and supply chain risk.

### Source excerpt

Chainguard and Upwind combine trusted, source-built artifacts with runtime verification to cut noise, reduce risk, and secure AI-era software.

## The litellm PyPI compromise and how Chainguard Libraries blocked malicious releases

DevFeed: [The litellm PyPI compromise and how Chainguard Libraries blocked malicious releases](<https://devfeed.tech/articles/you-were-one-pip-install-away-from-the-litellm-breach-chainguard-customers-weren-t-13344.md>)

Original publisher: [Read original article](<https://www.chainguard.dev/unchained/you-were-one-pip-install-away-from-a-breach-chainguard-customers-werent>)

Published: 2026-03-24T00:00:00Z

Content type: article

Language: en

Sources: [Chainguard: Unchained](<https://devfeed.tech/sources/chainguard-unchained.md>)

Topics: [litellm](<https://devfeed.tech/topics/litellm.md>), [chainguard libraries](<https://devfeed.tech/topics/chainguard-libraries.md>), [open-source-security](<https://devfeed.tech/topics/open-source-security.md>)

Tags: [chainguard-libraries](<https://devfeed.tech/tags/chainguard-libraries.md>), [chainguard-libraries-for-python](<https://devfeed.tech/tags/chainguard-libraries-for-python.md>), [litellm](<https://devfeed.tech/tags/litellm.md>), [litellm-attack](<https://devfeed.tech/tags/litellm-attack.md>), [litellm-package](<https://devfeed.tech/tags/litellm-package.md>), [litellm-supply-chain-attack](<https://devfeed.tech/tags/litellm-supply-chain-attack.md>), [open-source-security](<https://devfeed.tech/tags/open-source-security.md>), [pypi](<https://devfeed.tech/tags/pypi.md>), [secure-packages](<https://devfeed.tech/tags/secure-packages.md>), [security](<https://devfeed.tech/tags/security.md>), [supply-chain-attacks](<https://devfeed.tech/tags/supply-chain-attacks.md>)

### AI overview

The article describes a litellm compromise on PyPI in which malicious releases were used to steal secrets. It states that Chainguard Libraries prevented exposure by rebuilding only verified source and blocking the malicious releases.

### Source excerpt

Hackers compromised litellm on PyPI to steal secrets. Chainguard Libraries prevented exposure by rebuilding only verified source, blocking malicious releases.

## This Shit is Hard: Building hardened PyTorch wheels with upstream parity

DevFeed: [This Shit is Hard: Building hardened PyTorch wheels with upstream parity](<https://devfeed.tech/articles/this-shit-is-hard-building-hardened-pytorch-wheels-with-upstream-parity-13277.md>)

Original publisher: [Read original article](<https://www.chainguard.dev/unchained/this-shit-is-hard-building-hardened-pytorch-wheels-with-upstream-parity>)

Published: 2026-01-22T00:00:00Z

Content type: article

Language: en

Sources: [Chainguard: Unchained](<https://devfeed.tech/sources/chainguard-unchained.md>)

Topics: [PyTorch](<https://devfeed.tech/topics/pytorch.md>), [Dependency management](<https://devfeed.tech/topics/dependency-management.md>), [toolchain](<https://devfeed.tech/topics/toolchain.md>), [Python](<https://devfeed.tech/topics/python.md>), [Open Source](<https://devfeed.tech/topics/open-source.md>)

Tags: [chainguard](<https://devfeed.tech/tags/chainguard.md>), [chainguard-libraries](<https://devfeed.tech/tags/chainguard-libraries.md>), [chainguard-libraries-for-python](<https://devfeed.tech/tags/chainguard-libraries-for-python.md>), [compatibility](<https://devfeed.tech/tags/compatibility.md>), [dependency](<https://devfeed.tech/tags/dependency.md>), [python](<https://devfeed.tech/tags/python.md>), [pytorch](<https://devfeed.tech/tags/pytorch.md>), [pytorch-libraries](<https://devfeed.tech/tags/pytorch-libraries.md>), [pytorch-packages](<https://devfeed.tech/tags/pytorch-packages.md>), [toolchain](<https://devfeed.tech/tags/toolchain.md>)

### AI overview

Chainguard describes the engineering challenges of building hardened PyTorch wheels with upstream feature parity. The article covers dependency resolution, toolchain constraints, manylinux and binary compatibility, test infrastructure, and SLSA Level 2 provenance.

### Source excerpt

Learn how Chainguard tackled dependency resolution, toolchain challenges, and manylinux compatibility to deliver hardened PyTorch wheels.

## Introducing automatic, short-lived credentials for Chainguard Libraries for Python

DevFeed: [Introducing automatic, short-lived credentials for Chainguard Libraries for Python](<https://devfeed.tech/articles/introducing-automatic-short-lived-credentials-for-chainguard-libraries-for-python-13105.md>)

Original publisher: [Read original article](<https://www.chainguard.dev/unchained/introducing-automatic-short-lived-credentials-for-chainguard-libraries-for-python>)

Published: 2026-01-15T00:00:00Z

Content type: article

Language: en

Sources: [Chainguard: Unchained](<https://devfeed.tech/sources/chainguard-unchained.md>)

Topics: [chainguard libraries for python](<https://devfeed.tech/topics/chainguard-libraries-for-python.md>), [chainguard libraries](<https://devfeed.tech/topics/chainguard-libraries.md>), [Authentication](<https://devfeed.tech/topics/authentication.md>), [pip](<https://devfeed.tech/topics/pip.md>), [developer velocity](<https://devfeed.tech/topics/developer-velocity.md>), [Usability](<https://devfeed.tech/topics/usability.md>)

Tags: [authentication](<https://devfeed.tech/tags/authentication.md>), [chainguard-libraries](<https://devfeed.tech/tags/chainguard-libraries.md>), [chainguard-libraries-for-python](<https://devfeed.tech/tags/chainguard-libraries-for-python.md>), [chainguard-libraries-python](<https://devfeed.tech/tags/chainguard-libraries-python.md>), [chainguard-packages](<https://devfeed.tech/tags/chainguard-packages.md>), [chainguard-python-containers](<https://devfeed.tech/tags/chainguard-python-containers.md>), [developer-velocity](<https://devfeed.tech/tags/developer-velocity.md>), [github-actions](<https://devfeed.tech/tags/github-actions.md>), [pypi](<https://devfeed.tech/tags/pypi.md>), [python-libraries](<https://devfeed.tech/tags/python-libraries.md>), [python-packages](<https://devfeed.tech/tags/python-packages.md>), [secure-python-packages](<https://devfeed.tech/tags/secure-python-packages.md>), [security](<https://devfeed.tech/tags/security.md>), [usability](<https://devfeed.tech/tags/usability.md>)

### AI overview

Chainguard announces integrated authentication for Chainguard Libraries for Python through a keyring package. The package provides short-lived credentials that refresh automatically, enabling secure pip access without repeatedly creating, copying, or managing long-lived tokens. It supports local development and GitHub Actions environments with assumable identities.

### Source excerpt

New integrated authentication for Python Libraries with a keyring: use short-lived credentials for pip installs to stay secure without slowing developers down.

## Anchore Enterprise now validates Chainguard Libraries: prevent 98% of Python malware and eliminate high-severity CVE toil

DevFeed: [Anchore Enterprise now validates Chainguard Libraries: prevent 98% of Python malware and eliminate high-severity CVE toil](<https://devfeed.tech/articles/anchore-enterprise-now-validates-chainguard-libraries-prevent-98-of-python-malware-and-eliminate-high-severity-cve-toil-12872.md>)

Original publisher: [Read original article](<https://www.chainguard.dev/unchained/anchore-enterprise-now-validates-chainguard-libraries>)

Published: 2025-12-04T00:00:00Z

Content type: article

Language: en

Sources: [Chainguard: Unchained](<https://devfeed.tech/sources/chainguard-unchained.md>)

Topics: [chainguard libraries](<https://devfeed.tech/topics/chainguard-libraries.md>), [Python](<https://devfeed.tech/topics/python.md>), [supply-chain-security](<https://devfeed.tech/topics/supply-chain-security.md>), [Malware](<https://devfeed.tech/topics/malware.md>), [Open Source](<https://devfeed.tech/topics/open-source.md>)

Tags: [anchore](<https://devfeed.tech/tags/anchore.md>), [anchore-chainguard](<https://devfeed.tech/tags/anchore-chainguard.md>), [anchore-chainguard-partnership](<https://devfeed.tech/tags/anchore-chainguard-partnership.md>), [anchore-enterprise](<https://devfeed.tech/tags/anchore-enterprise.md>), [chainguard](<https://devfeed.tech/tags/chainguard.md>), [chainguard-libraries](<https://devfeed.tech/tags/chainguard-libraries.md>), [chainguard-libraries-for-python](<https://devfeed.tech/tags/chainguard-libraries-for-python.md>), [dependencies](<https://devfeed.tech/tags/dependencies.md>), [malware](<https://devfeed.tech/tags/malware.md>), [provenance](<https://devfeed.tech/tags/provenance.md>), [python](<https://devfeed.tech/tags/python.md>), [sboms](<https://devfeed.tech/tags/sboms.md>), [slsa](<https://devfeed.tech/tags/slsa.md>), [supply-chain](<https://devfeed.tech/tags/supply-chain.md>), [supply-chain-security](<https://devfeed.tech/tags/supply-chain-security.md>)

### AI overview

Anchore Enterprise now supports scanning and validating Chainguard Libraries for Python. The integration combines Anchore's supply-chain security enforcement with Python libraries built from source in a tamper-proof, SLSA L2-certified environment with provenance and signed SBOMs, aiming to prevent malware introduced during build or distribution and reduce high-severity CVE remediation effort.

### Source excerpt

Customers can now leverage Anchore Enterprise's scanning capabilities for Chainguard Libraries for Python.

## Announcing AWS Inspector scanner support for Chainguard Libraries

DevFeed: [Announcing AWS Inspector scanner support for Chainguard Libraries](<https://devfeed.tech/articles/announcing-aws-inspector-scanner-support-for-chainguard-libraries-12874.md>)

Original publisher: [Read original article](<https://www.chainguard.dev/unchained/announcing-aws-inspector-scanner-support-for-chainguard-libraries>)

Published: 2025-11-24T00:00:00Z

Content type: news

Language: en

Sources: [Chainguard: Unchained](<https://devfeed.tech/sources/chainguard-unchained.md>)

Topics: [chainguard libraries](<https://devfeed.tech/topics/chainguard-libraries.md>), [Amazon Web Services](<https://devfeed.tech/topics/aws.md>), [vulnerability management](<https://devfeed.tech/topics/vulnerability-management.md>), [Malware](<https://devfeed.tech/topics/malware.md>), [vulnerability](<https://devfeed.tech/topics/vulnerability.md>), [container images](<https://devfeed.tech/topics/container-images.md>), [Python](<https://devfeed.tech/topics/python.md>), [Django](<https://devfeed.tech/topics/django.md>), [Flask](<https://devfeed.tech/topics/flask.md>)

Tags: [amazon-scanner-support](<https://devfeed.tech/tags/amazon-scanner-support.md>), [aws](<https://devfeed.tech/tags/aws.md>), [aws-inspector](<https://devfeed.tech/tags/aws-inspector.md>), [chainguard-aws-integration](<https://devfeed.tech/tags/chainguard-aws-integration.md>), [chainguard-libraries](<https://devfeed.tech/tags/chainguard-libraries.md>), [chainguard-libraries-for-python](<https://devfeed.tech/tags/chainguard-libraries-for-python.md>), [chainguard-libraries-for-python-aws](<https://devfeed.tech/tags/chainguard-libraries-for-python-aws.md>), [chainguard-packages](<https://devfeed.tech/tags/chainguard-packages.md>), [container-images](<https://devfeed.tech/tags/container-images.md>), [cve](<https://devfeed.tech/tags/cve.md>), [cve-remediation](<https://devfeed.tech/tags/cve-remediation.md>), [django](<https://devfeed.tech/tags/django.md>), [flask](<https://devfeed.tech/tags/flask.md>), [malware](<https://devfeed.tech/tags/malware.md>), [malware-prevention](<https://devfeed.tech/tags/malware-prevention.md>), [python](<https://devfeed.tech/tags/python.md>), [security](<https://devfeed.tech/tags/security.md>), [vulnerabilities](<https://devfeed.tech/tags/vulnerabilities.md>), [vulnerability](<https://devfeed.tech/tags/vulnerability.md>), [vulnerability-management](<https://devfeed.tech/tags/vulnerability-management.md>)

### AI overview

Chainguard Libraries for Python now integrates with Amazon Inspector's enhanced scanning for Amazon ECR. The integration provides malware prevention, recognition of Chainguard-remediated CVEs, and a unified view of container and library vulnerabilities across AWS workloads.

### Source excerpt

Chainguard Libraries now integrates with AWS Inspector, bringing proactive malware prevention, CVE remediation, and vulnerability visibility across AWS workloads

## Chainguard Libraries for Python: Now Generally Available with CVE Remediation and Malware Protection

DevFeed: [Chainguard Libraries for Python: Now Generally Available with CVE Remediation and Malware Protection](<https://devfeed.tech/articles/chainguard-libraries-for-python-now-generally-available-with-cve-remediation-and-malware-protection-12967.md>)

Original publisher: [Read original article](<https://www.chainguard.dev/unchained/chainguard-libraries-for-python-now-generally-available-with-cve-remediation-and-malware-protection>)

Published: 2025-10-22T00:00:00Z

Content type: release

Language: en

Sources: [Chainguard: Unchained](<https://devfeed.tech/sources/chainguard-unchained.md>)

Topics: [chainguard libraries for python](<https://devfeed.tech/topics/chainguard-libraries-for-python.md>), [chainguard libraries](<https://devfeed.tech/topics/chainguard-libraries.md>), [Python](<https://devfeed.tech/topics/python.md>), [Malware](<https://devfeed.tech/topics/malware.md>), [Open Source](<https://devfeed.tech/topics/open-source.md>), [supply-chain-security](<https://devfeed.tech/topics/supply-chain-security.md>), [Vulnerabilities](<https://devfeed.tech/topics/vulnerabilities.md>)

Tags: [chainguard](<https://devfeed.tech/tags/chainguard.md>), [chainguard-language-libraries](<https://devfeed.tech/tags/chainguard-language-libraries.md>), [chainguard-libraries](<https://devfeed.tech/tags/chainguard-libraries.md>), [chainguard-libraries-for-python](<https://devfeed.tech/tags/chainguard-libraries-for-python.md>), [cve](<https://devfeed.tech/tags/cve.md>), [cve-remediation](<https://devfeed.tech/tags/cve-remediation.md>), [language-libraries-malware](<https://devfeed.tech/tags/language-libraries-malware.md>), [malware-prevention](<https://devfeed.tech/tags/malware-prevention.md>), [malware-protection](<https://devfeed.tech/tags/malware-protection.md>), [open-source](<https://devfeed.tech/tags/open-source.md>), [python](<https://devfeed.tech/tags/python.md>), [python-libraries](<https://devfeed.tech/tags/python-libraries.md>), [secure-python-libraries](<https://devfeed.tech/tags/secure-python-libraries.md>), [software-supply-chain](<https://devfeed.tech/tags/software-supply-chain.md>), [supply-chain-attacks](<https://devfeed.tech/tags/supply-chain-attacks.md>), [vulnerabilities](<https://devfeed.tech/tags/vulnerabilities.md>)

### AI overview

Chainguard Libraries for Python is generally available as a trusted-build distribution of open source Python libraries. It builds packages from source, distributes them through hardened infrastructure, continuously monitors them, and provides malware protection and CVE remediation through backported patches for selected critical and high-severity vulnerabilities.

### Source excerpt

Chainguard Libraries for Python, trusted open source language libraries designed for CVE remediation and malware protection, is now generally available.

## Registries and the npm Breach: Securing the Weakest Link in the Software Supply Chain

DevFeed: [Registries and the npm Breach: Securing the Weakest Link in the Software Supply Chain](<https://devfeed.tech/articles/registries-and-the-npm-breach-securing-the-weakest-link-in-the-software-supply-chain-13208.md>)

Original publisher: [Read original article](<https://www.chainguard.dev/unchained/registries-and-the-npm-breach-securing-the-weakest-link-in-the-software-supply-chain>)

Published: 2025-09-10T00:00:00Z

Content type: article

Language: en

Sources: [Chainguard: Unchained](<https://devfeed.tech/sources/chainguard-unchained.md>)

Topics: [supply-chain-security](<https://devfeed.tech/topics/supply-chain-security.md>), [npm](<https://devfeed.tech/topics/npm.md>), [chainguard libraries](<https://devfeed.tech/topics/chainguard-libraries.md>), [Malware](<https://devfeed.tech/topics/malware.md>), [Software](<https://devfeed.tech/topics/software.md>)

Tags: [account-takeover](<https://devfeed.tech/tags/account-takeover.md>), [api-keys](<https://devfeed.tech/tags/api-keys.md>), [chainguard-libraries](<https://devfeed.tech/tags/chainguard-libraries.md>), [chainguard-libraries-for-java](<https://devfeed.tech/tags/chainguard-libraries-for-java.md>), [chainguard-libraries-for-python](<https://devfeed.tech/tags/chainguard-libraries-for-python.md>), [ci-cd](<https://devfeed.tech/tags/ci-cd.md>), [malware](<https://devfeed.tech/tags/malware.md>), [malware-prevention](<https://devfeed.tech/tags/malware-prevention.md>), [npm](<https://devfeed.tech/tags/npm.md>), [npm-compromise](<https://devfeed.tech/tags/npm-compromise.md>), [security](<https://devfeed.tech/tags/security.md>), [software-supply-chain](<https://devfeed.tech/tags/software-supply-chain.md>), [supply-chain](<https://devfeed.tech/tags/supply-chain.md>), [supply-chain-attacks](<https://devfeed.tech/tags/supply-chain-attacks.md>)

### AI overview

The article examines a compromise affecting 20 popular npm packages and explains how package-registry attacks can steal environment variables and API keys, establish production backdoors, compromise CI/CD processes, and evade existing supply-chain controls. It presents Chainguard Libraries as a defense based on going back to source repositories.

### Source excerpt

Chainguard Libraries provides a different and proven defense against supply chain attacks like the recent npm breach. See why preventing malware is important.

## Malware-Resistant Python without the Guesswork

DevFeed: [Malware-Resistant Python without the Guesswork](<https://devfeed.tech/articles/malware-resistant-python-without-the-guesswork-13146.md>)

Original publisher: [Read original article](<https://www.chainguard.dev/unchained/malware-resistant-python-without-the-guesswork>)

Published: 2025-08-01T00:00:00Z

Content type: opinion

Language: en

Sources: [Chainguard: Unchained](<https://devfeed.tech/sources/chainguard-unchained.md>)

Topics: [chainguard libraries for python](<https://devfeed.tech/topics/chainguard-libraries-for-python.md>), [chainguard libraries](<https://devfeed.tech/topics/chainguard-libraries.md>), [Security](<https://devfeed.tech/topics/security.md>), [chainguard](<https://devfeed.tech/topics/chainguard.md>), [Open Source](<https://devfeed.tech/topics/open-source.md>), [Malware](<https://devfeed.tech/topics/malware.md>)

Tags: [chainguard-libraries](<https://devfeed.tech/tags/chainguard-libraries.md>), [chainguard-libraries-for-python](<https://devfeed.tech/tags/chainguard-libraries-for-python.md>), [malicious-packages](<https://devfeed.tech/tags/malicious-packages.md>), [malware](<https://devfeed.tech/tags/malware.md>), [num2words](<https://devfeed.tech/tags/num2words.md>), [provenance](<https://devfeed.tech/tags/provenance.md>), [pypi](<https://devfeed.tech/tags/pypi.md>), [python](<https://devfeed.tech/tags/python.md>), [reproducibility](<https://devfeed.tech/tags/reproducibility.md>), [sbom](<https://devfeed.tech/tags/sbom.md>), [secure-packages](<https://devfeed.tech/tags/secure-packages.md>), [security](<https://devfeed.tech/tags/security.md>), [signing](<https://devfeed.tech/tags/signing.md>), [slsa](<https://devfeed.tech/tags/slsa.md>), [supply-chain](<https://devfeed.tech/tags/supply-chain.md>)

### AI overview

The article presents Chainguard Libraries for Python as a way to reduce malware and software supply chain risks in Python package consumption. It describes rebuilding packages from upstream source in an isolated, reproducible SLSA Level 2 environment, and publishing signed SBOMs and provenance information.

### Source excerpt

The recent compromise of the num2words package never made it into Chainguard Libraries for Python. Get the breakdown from the team on our packages you can trust.

## Guarding the Python Ecosystem Against the Growing Number of Severe Malware Attacks

DevFeed: [Guarding the Python Ecosystem Against the Growing Number of Severe Malware Attacks](<https://devfeed.tech/articles/guarding-the-python-ecosystem-against-the-growing-number-of-severe-malware-attacks-13075.md>)

Original publisher: [Read original article](<https://www.chainguard.dev/unchained/guarding-the-python-ecosystem-against-the-growing-number-of-severe-malware-attacks>)

Published: 2025-05-21T00:00:00Z

Content type: article

Language: en

Sources: [Chainguard: Unchained](<https://devfeed.tech/sources/chainguard-unchained.md>)

Topics: [chainguard libraries for python](<https://devfeed.tech/topics/chainguard-libraries-for-python.md>), [chainguard libraries](<https://devfeed.tech/topics/chainguard-libraries.md>), [Malware](<https://devfeed.tech/topics/malware.md>), [PyPI](<https://devfeed.tech/topics/pypi.md>), [open-source-security](<https://devfeed.tech/topics/open-source-security.md>), [supply-chain-security](<https://devfeed.tech/topics/supply-chain-security.md>)

Tags: [chainguard-libraries](<https://devfeed.tech/tags/chainguard-libraries.md>), [chainguard-libraries-for-python](<https://devfeed.tech/tags/chainguard-libraries-for-python.md>), [libraries](<https://devfeed.tech/tags/libraries.md>), [malware](<https://devfeed.tech/tags/malware.md>), [open-source-software](<https://devfeed.tech/tags/open-source-software.md>), [packages](<https://devfeed.tech/tags/packages.md>), [pypi](<https://devfeed.tech/tags/pypi.md>), [python](<https://devfeed.tech/tags/python.md>), [security](<https://devfeed.tech/tags/security.md>), [software-supply-chain](<https://devfeed.tech/tags/software-supply-chain.md>), [software-supply-chain-security](<https://devfeed.tech/tags/software-supply-chain-security.md>)

### AI overview

The article explains that growing reliance on Python packages from PyPI increases exposure to malware risks. It presents Chainguard Libraries for Python as a more secure package index whose libraries and dependency trees are built from source in hardened infrastructure.

### Source excerpt

Chainguard developed Chainguard Libraries for Python to help guard the Python ecosystem against malware attacks. Discover why we did it and how it works.

## Announcing Chainguard Libraries for Python: Malware-Resistant Dependencies Built Securely from Source

DevFeed: [Announcing Chainguard Libraries for Python: Malware-Resistant Dependencies Built Securely from Source](<https://devfeed.tech/articles/announcing-chainguard-libraries-for-python-malware-resistant-dependencies-built-securely-from-source-12880.md>)

Original publisher: [Read original article](<https://www.chainguard.dev/unchained/announcing-chainguard-libraries-for-python-malware-resistant-dependencies-built-securely-from-source>)

Published: 2025-05-14T00:00:00Z

Content type: release

Language: en

Sources: [Chainguard: Unchained](<https://devfeed.tech/sources/chainguard-unchained.md>)

Topics: [chainguard libraries for python](<https://devfeed.tech/topics/chainguard-libraries-for-python.md>), [Malware](<https://devfeed.tech/topics/malware.md>), [Python](<https://devfeed.tech/topics/python.md>), [supply-chain-security](<https://devfeed.tech/topics/supply-chain-security.md>), [chainguard libraries](<https://devfeed.tech/topics/chainguard-libraries.md>)

Tags: [chainguard-libraries](<https://devfeed.tech/tags/chainguard-libraries.md>), [chainguard-libraries-for-python](<https://devfeed.tech/tags/chainguard-libraries-for-python.md>), [chibbies](<https://devfeed.tech/tags/chibbies.md>), [malware](<https://devfeed.tech/tags/malware.md>), [provenance](<https://devfeed.tech/tags/provenance.md>), [python](<https://devfeed.tech/tags/python.md>), [python-libraries](<https://devfeed.tech/tags/python-libraries.md>), [pytorch](<https://devfeed.tech/tags/pytorch.md>), [safe-source-for-open-source](<https://devfeed.tech/tags/safe-source-for-open-source.md>), [supply-chain-security](<https://devfeed.tech/tags/supply-chain-security.md>), [ultralytics](<https://devfeed.tech/tags/ultralytics.md>)

### AI overview

Chainguard announces the early access release of Chainguard Libraries for Python, a malware-resistant index of Python dependencies built securely from source. It is intended to help application security and platform engineering teams address supply chain attacks during build and distribution, including risks from native dependencies and bundled operating system libraries. The libraries maintain compatibility across Chainguard OS, RHEL, Debian, and Ubuntu.

### Source excerpt

Chainguard Libraries for Python is an index of Python dependencies designed to protect users from malware attacks at the build and distribution stages.