# chainguard packages

Published articles for chainguard packages.

This is one page of public article previews, not the complete archive. Follow Next page to continue. Summaries are not the original full articles.

## @mastra npm scope takeover: 143 packages backdoored via compromised contributor account

DevFeed: [@mastra npm scope takeover: 143 packages backdoored via compromised contributor account](<https://devfeed.tech/articles/mastra-npm-scope-takeover-143-packages-backdoored-via-compromised-contributor-account-13149.md>)

Original publisher: [Read original article](<https://www.chainguard.dev/unchained/mastra-npm-scope-takeover-143-packages-backdoored-via-compromised-contributor-account>)

Published: 2026-06-17T00:00:00Z

Content type: article

Language: en

Sources: [Chainguard: Unchained](<https://devfeed.tech/sources/chainguard-unchained.md>)

Topics: [npm](<https://devfeed.tech/topics/npm.md>), [Malware](<https://devfeed.tech/topics/malware.md>), [Remote Access Trojan](<https://devfeed.tech/topics/remote-access-trojan.md>), [Cryptocurrency](<https://devfeed.tech/topics/cryptocurrency.md>), [C2](<https://devfeed.tech/topics/c2.md>)

Tags: [c2](<https://devfeed.tech/tags/c2.md>), [chainguard-libraries](<https://devfeed.tech/tags/chainguard-libraries.md>), [chainguard-packages](<https://devfeed.tech/tags/chainguard-packages.md>), [command-and-control](<https://devfeed.tech/tags/command-and-control.md>), [crypto](<https://devfeed.tech/tags/crypto.md>), [malware](<https://devfeed.tech/tags/malware.md>), [mastra](<https://devfeed.tech/tags/mastra.md>), [npm](<https://devfeed.tech/tags/npm.md>), [npm-takeover](<https://devfeed.tech/tags/npm-takeover.md>), [packages](<https://devfeed.tech/tags/packages.md>), [provenance](<https://devfeed.tech/tags/provenance.md>), [remote-access](<https://devfeed.tech/tags/remote-access.md>), [remote-access-trojan](<https://devfeed.tech/tags/remote-access-trojan.md>), [secure-packages](<https://devfeed.tech/tags/secure-packages.md>), [software-packages](<https://devfeed.tech/tags/software-packages.md>), [supply-chain](<https://devfeed.tech/tags/supply-chain.md>), [tls](<https://devfeed.tech/tags/tls.md>)

### AI overview

The article reports that an attacker used a compromised former contributor account to republish all 143 packages in the @mastra npm scope on June 17, 2026. The malicious versions could disable TLS verification, download a cryptocurrency wallet stealer and remote access trojan, and establish command-and-control access. It recommends auditing dependency trees and lockfiles and rotating credentials on affected hosts.

### Source excerpt

A supply chain attack compromised all 143 @mastra packages. Chainguard customers stayed protected through malware blocking and source-built libraries.

## How we automatically test the world's most secure Linux distribution

DevFeed: [How we automatically test the world's most secure Linux distribution](<https://devfeed.tech/articles/how-we-automatically-test-the-world-s-most-secure-linux-distribution-13098.md>)

Original publisher: [Read original article](<https://www.chainguard.dev/unchained/how-we-automatically-test-the-worlds-most-secure-linux-distribution>)

Published: 2026-05-01T00:00:00Z

Content type: article

Language: en

Sources: [Chainguard: Unchained](<https://devfeed.tech/sources/chainguard-unchained.md>)

Topics: [test-coverage](<https://devfeed.tech/topics/test-coverage.md>), [chainguard os](<https://devfeed.tech/topics/chainguard-os.md>), [Linux](<https://devfeed.tech/topics/linux.md>), [chainguard containers](<https://devfeed.tech/topics/chainguard-containers.md>)

Tags: [chainguard](<https://devfeed.tech/tags/chainguard.md>), [chainguard-containers](<https://devfeed.tech/tags/chainguard-containers.md>), [chainguard-os](<https://devfeed.tech/tags/chainguard-os.md>), [chainguard-packages](<https://devfeed.tech/tags/chainguard-packages.md>), [chainguard-testing](<https://devfeed.tech/tags/chainguard-testing.md>), [linux](<https://devfeed.tech/tags/linux.md>), [test-coverage](<https://devfeed.tech/tags/test-coverage.md>)

### AI overview

Chainguard OS has achieved 100% test coverage across its package and subpackage catalog. The automated tests execute software, verify behavior, and test service lifecycles across x86_64 and aarch64 packages before release.

### Source excerpt

Chainguard OS achieves 100% package test coverage, verifying every component runs correctly to make rolling updates secure, reliable, and enterprise-ready.

## Introducing Chainguard OS Packages: Secure ingredients for custom container builds

DevFeed: [Introducing Chainguard OS Packages: Secure ingredients for custom container builds](<https://devfeed.tech/articles/introducing-chainguard-os-packages-secure-ingredients-for-custom-container-builds-13112.md>)

Original publisher: [Read original article](<https://www.chainguard.dev/unchained/introducing-chainguard-os-packages>)

Published: 2026-03-17T00:00:00Z

Content type: article

Language: en

Sources: [Chainguard: Unchained](<https://devfeed.tech/sources/chainguard-unchained.md>)

Topics: [chainguard](<https://devfeed.tech/topics/chainguard.md>), [chainguard os](<https://devfeed.tech/topics/chainguard-os.md>), [container images](<https://devfeed.tech/topics/container-images.md>), [Docker Hardened Images](<https://devfeed.tech/topics/docker-hardened-images.md>), [Vulnerabilities](<https://devfeed.tech/topics/vulnerabilities.md>), [Linux](<https://devfeed.tech/topics/linux.md>), [Automation](<https://devfeed.tech/topics/automation.md>), [Dockerfile](<https://devfeed.tech/topics/dockerfile.md>), [Open Source](<https://devfeed.tech/topics/open-source.md>), [bazel](<https://devfeed.tech/topics/bazel.md>), [chainguard sboms](<https://devfeed.tech/topics/chainguard-sboms.md>), [APK](<https://devfeed.tech/topics/apk.md>)

Tags: [apk](<https://devfeed.tech/tags/apk.md>), [apko](<https://devfeed.tech/tags/apko.md>), [automation](<https://devfeed.tech/tags/automation.md>), [base-images](<https://devfeed.tech/tags/base-images.md>), [bazel](<https://devfeed.tech/tags/bazel.md>), [chainguard](<https://devfeed.tech/tags/chainguard.md>), [chainguard-containers](<https://devfeed.tech/tags/chainguard-containers.md>), [chainguard-libraries](<https://devfeed.tech/tags/chainguard-libraries.md>), [chainguard-os](<https://devfeed.tech/tags/chainguard-os.md>), [chainguard-os-packages](<https://devfeed.tech/tags/chainguard-os-packages.md>), [chainguard-packages](<https://devfeed.tech/tags/chainguard-packages.md>), [chainguard-sboms](<https://devfeed.tech/tags/chainguard-sboms.md>), [container](<https://devfeed.tech/tags/container.md>), [container-images](<https://devfeed.tech/tags/container-images.md>), [cve](<https://devfeed.tech/tags/cve.md>), [dockerfiles](<https://devfeed.tech/tags/dockerfiles.md>), [open-source](<https://devfeed.tech/tags/open-source.md>), [sboms](<https://devfeed.tech/tags/sboms.md>), [secure-software-packages](<https://devfeed.tech/tags/secure-software-packages.md>), [software-packages](<https://devfeed.tech/tags/software-packages.md>), [vulnerabilities](<https://devfeed.tech/tags/vulnerabilities.md>), [zero-cve-packages](<https://devfeed.tech/tags/zero-cve-packages.md>)

### AI overview

Chainguard introduces Chainguard OS Packages, a service providing continuously maintained, enterprise-grade packages and base images for teams that build custom container images. Customers retain control over image composition and build tooling while Chainguard handles package sourcing, rebuilding, vulnerability remediation, and SBOM generation.

### Source excerpt

Chainguard OS Packages are enterprise-grade, zero-CVE packages and base images built and continuously maintained in the Chainguard Factory.

## Introducing automatic, short-lived credentials for Chainguard Libraries for Python

DevFeed: [Introducing automatic, short-lived credentials for Chainguard Libraries for Python](<https://devfeed.tech/articles/introducing-automatic-short-lived-credentials-for-chainguard-libraries-for-python-13105.md>)

Original publisher: [Read original article](<https://www.chainguard.dev/unchained/introducing-automatic-short-lived-credentials-for-chainguard-libraries-for-python>)

Published: 2026-01-15T00:00:00Z

Content type: article

Language: en

Sources: [Chainguard: Unchained](<https://devfeed.tech/sources/chainguard-unchained.md>)

Topics: [chainguard libraries for python](<https://devfeed.tech/topics/chainguard-libraries-for-python.md>), [chainguard libraries](<https://devfeed.tech/topics/chainguard-libraries.md>), [Authentication](<https://devfeed.tech/topics/authentication.md>), [pip](<https://devfeed.tech/topics/pip.md>), [developer velocity](<https://devfeed.tech/topics/developer-velocity.md>), [Usability](<https://devfeed.tech/topics/usability.md>)

Tags: [authentication](<https://devfeed.tech/tags/authentication.md>), [chainguard-libraries](<https://devfeed.tech/tags/chainguard-libraries.md>), [chainguard-libraries-for-python](<https://devfeed.tech/tags/chainguard-libraries-for-python.md>), [chainguard-libraries-python](<https://devfeed.tech/tags/chainguard-libraries-python.md>), [chainguard-packages](<https://devfeed.tech/tags/chainguard-packages.md>), [chainguard-python-containers](<https://devfeed.tech/tags/chainguard-python-containers.md>), [developer-velocity](<https://devfeed.tech/tags/developer-velocity.md>), [github-actions](<https://devfeed.tech/tags/github-actions.md>), [pypi](<https://devfeed.tech/tags/pypi.md>), [python-libraries](<https://devfeed.tech/tags/python-libraries.md>), [python-packages](<https://devfeed.tech/tags/python-packages.md>), [secure-python-packages](<https://devfeed.tech/tags/secure-python-packages.md>), [security](<https://devfeed.tech/tags/security.md>), [usability](<https://devfeed.tech/tags/usability.md>)

### AI overview

Chainguard announces integrated authentication for Chainguard Libraries for Python through a keyring package. The package provides short-lived credentials that refresh automatically, enabling secure pip access without repeatedly creating, copying, or managing long-lived tokens. It supports local development and GitHub Actions environments with assumable identities.

### Source excerpt

New integrated authentication for Python Libraries with a keyring: use short-lived credentials for pip installs to stay secure without slowing developers down.

## Announcing AWS Inspector scanner support for Chainguard Libraries

DevFeed: [Announcing AWS Inspector scanner support for Chainguard Libraries](<https://devfeed.tech/articles/announcing-aws-inspector-scanner-support-for-chainguard-libraries-12874.md>)

Original publisher: [Read original article](<https://www.chainguard.dev/unchained/announcing-aws-inspector-scanner-support-for-chainguard-libraries>)

Published: 2025-11-24T00:00:00Z

Content type: news

Language: en

Sources: [Chainguard: Unchained](<https://devfeed.tech/sources/chainguard-unchained.md>)

Topics: [chainguard libraries](<https://devfeed.tech/topics/chainguard-libraries.md>), [Amazon Web Services](<https://devfeed.tech/topics/aws.md>), [vulnerability management](<https://devfeed.tech/topics/vulnerability-management.md>), [Malware](<https://devfeed.tech/topics/malware.md>), [vulnerability](<https://devfeed.tech/topics/vulnerability.md>), [container images](<https://devfeed.tech/topics/container-images.md>), [Python](<https://devfeed.tech/topics/python.md>), [Django](<https://devfeed.tech/topics/django.md>), [Flask](<https://devfeed.tech/topics/flask.md>)

Tags: [amazon-scanner-support](<https://devfeed.tech/tags/amazon-scanner-support.md>), [aws](<https://devfeed.tech/tags/aws.md>), [aws-inspector](<https://devfeed.tech/tags/aws-inspector.md>), [chainguard-aws-integration](<https://devfeed.tech/tags/chainguard-aws-integration.md>), [chainguard-libraries](<https://devfeed.tech/tags/chainguard-libraries.md>), [chainguard-libraries-for-python](<https://devfeed.tech/tags/chainguard-libraries-for-python.md>), [chainguard-libraries-for-python-aws](<https://devfeed.tech/tags/chainguard-libraries-for-python-aws.md>), [chainguard-packages](<https://devfeed.tech/tags/chainguard-packages.md>), [container-images](<https://devfeed.tech/tags/container-images.md>), [cve](<https://devfeed.tech/tags/cve.md>), [cve-remediation](<https://devfeed.tech/tags/cve-remediation.md>), [django](<https://devfeed.tech/tags/django.md>), [flask](<https://devfeed.tech/tags/flask.md>), [malware](<https://devfeed.tech/tags/malware.md>), [malware-prevention](<https://devfeed.tech/tags/malware-prevention.md>), [python](<https://devfeed.tech/tags/python.md>), [security](<https://devfeed.tech/tags/security.md>), [vulnerabilities](<https://devfeed.tech/tags/vulnerabilities.md>), [vulnerability](<https://devfeed.tech/tags/vulnerability.md>), [vulnerability-management](<https://devfeed.tech/tags/vulnerability-management.md>)

### AI overview

Chainguard Libraries for Python now integrates with Amazon Inspector's enhanced scanning for Amazon ECR. The integration provides malware prevention, recognition of Chainguard-remediated CVEs, and a unified view of container and library vulnerabilities across AWS workloads.

### Source excerpt

Chainguard Libraries now integrates with AWS Inspector, bringing proactive malware prevention, CVE remediation, and vulnerability visibility across AWS workloads