# chainguard libraries

Chainguard Libraries for JavaScript provides drop-in replacements for npm packages, built from source in a SLSA L3-compliant environment.

This is one page of public article previews, not the complete archive. Follow Next page to continue. Summaries are not the original full articles.

## Chainguard Libraries now available on AWS Security Hub Extended

DevFeed: [Chainguard Libraries now available on AWS Security Hub Extended](<https://devfeed.tech/articles/chainguard-libraries-now-available-on-aws-security-hub-extended-12969.md>)

Original publisher: [Read original article](<https://www.chainguard.dev/unchained/chainguard-libraries-now-available-on-aws-security-hub-extended>)

Published: 2026-08-04T00:00:00Z

Content type: article

Language: en

Sources: [Chainguard: Unchained](<https://devfeed.tech/sources/chainguard-unchained.md>)

Topics: [chainguard libraries](<https://devfeed.tech/topics/chainguard-libraries.md>), [AWS Security Hub](<https://devfeed.tech/topics/aws-security-hub.md>), [Security](<https://devfeed.tech/topics/security.md>), [software supply-chain attack](<https://devfeed.tech/topics/software-supply-chain-attack.md>), [Malware](<https://devfeed.tech/topics/malware.md>), [Open Source](<https://devfeed.tech/topics/open-source.md>), [Amazon Web Services](<https://devfeed.tech/topics/aws.md>)

Tags: [ai-coding](<https://devfeed.tech/tags/ai-coding.md>), [aws-security-hub](<https://devfeed.tech/tags/aws-security-hub.md>), [axios](<https://devfeed.tech/tags/axios.md>), [chainguard-libraries](<https://devfeed.tech/tags/chainguard-libraries.md>), [dependencies](<https://devfeed.tech/tags/dependencies.md>), [java](<https://devfeed.tech/tags/java.md>), [javascript](<https://devfeed.tech/tags/javascript.md>), [litellm](<https://devfeed.tech/tags/litellm.md>), [malware](<https://devfeed.tech/tags/malware.md>), [mini-shai-hulud](<https://devfeed.tech/tags/mini-shai-hulud.md>), [npm](<https://devfeed.tech/tags/npm.md>), [open-source](<https://devfeed.tech/tags/open-source.md>), [python](<https://devfeed.tech/tags/python.md>), [redhat](<https://devfeed.tech/tags/redhat.md>), [redhat-cloud-services](<https://devfeed.tech/tags/redhat-cloud-services.md>), [security](<https://devfeed.tech/tags/security.md>), [shai-hulud](<https://devfeed.tech/tags/shai-hulud.md>), [software-supply-chain](<https://devfeed.tech/tags/software-supply-chain.md>), [software-supply-chain-attack](<https://devfeed.tech/tags/software-supply-chain-attack.md>), [telnyx](<https://devfeed.tech/tags/telnyx.md>)

### AI overview

Chainguard Libraries is now available through AWS Security Hub Extended's Supply Chain category. The article presents it as a malware-free catalog of Python, Java, and JavaScript dependencies intended to reduce reliance on public registries and help protect AWS workloads from software supply-chain attacks.

### Source excerpt

Chainguard Libraries is now available in AWS Security Hub Extended, delivering malware-resistant open source dependencies for AWS workloads.

## Booz Allen Hamilton signs enterprise license agreement with Chainguard

DevFeed: [Booz Allen Hamilton signs enterprise license agreement with Chainguard](<https://devfeed.tech/articles/booz-allen-hamilton-signs-enterprise-license-agreement-with-chainguard-12897.md>)

Original publisher: [Read original article](<https://www.chainguard.dev/unchained/booz-allen-hamilton-signs-enterprise-license-agreement-with-chainguard>)

Published: 2026-07-21T00:00:00Z

Content type: release

Language: en

Sources: [Chainguard: Unchained](<https://devfeed.tech/sources/chainguard-unchained.md>)

Topics: [chainguard containers](<https://devfeed.tech/topics/chainguard-containers.md>), [chainguard libraries](<https://devfeed.tech/topics/chainguard-libraries.md>), [open-source-security](<https://devfeed.tech/topics/open-source-security.md>), [Security](<https://devfeed.tech/topics/security.md>), [Vulnerabilities](<https://devfeed.tech/topics/vulnerabilities.md>), [Open Source](<https://devfeed.tech/topics/open-source.md>), [Development](<https://devfeed.tech/topics/development.md>)

Tags: [announce](<https://devfeed.tech/tags/announce.md>), [ato](<https://devfeed.tech/tags/ato.md>), [authority-to-operate](<https://devfeed.tech/tags/authority-to-operate.md>), [booz-allen-hamilton](<https://devfeed.tech/tags/booz-allen-hamilton.md>), [booz-allen-hamilton-engineering](<https://devfeed.tech/tags/booz-allen-hamilton-engineering.md>), [booz-chainguard-partnership](<https://devfeed.tech/tags/booz-chainguard-partnership.md>), [chainguard](<https://devfeed.tech/tags/chainguard.md>), [chainguard-booz](<https://devfeed.tech/tags/chainguard-booz.md>), [chainguard-containers](<https://devfeed.tech/tags/chainguard-containers.md>), [chainguard-libraries](<https://devfeed.tech/tags/chainguard-libraries.md>), [compliance](<https://devfeed.tech/tags/compliance.md>), [container-images](<https://devfeed.tech/tags/container-images.md>), [development](<https://devfeed.tech/tags/development.md>), [enterprise](<https://devfeed.tech/tags/enterprise.md>), [government](<https://devfeed.tech/tags/government.md>), [partner](<https://devfeed.tech/tags/partner.md>), [secure-by-default](<https://devfeed.tech/tags/secure-by-default.md>), [security](<https://devfeed.tech/tags/security.md>), [supply-chain](<https://devfeed.tech/tags/supply-chain.md>), [trust](<https://devfeed.tech/tags/trust.md>), [us](<https://devfeed.tech/tags/us.md>), [vulnerabilities](<https://devfeed.tech/tags/vulnerabilities.md>)

### AI overview

Booz Allen Hamilton has signed an enterprise license agreement with Chainguard, giving more than 6,000 engineers access to Chainguard Containers and Chainguard Libraries across U.S. government programs. The agreement is intended to support secure-by-default software delivery, vulnerability remediation, compliance, and software supply chain requirements.

### Source excerpt

Booz Allen and Chainguard partner to help 6,000+ engineers deliver secure-by-default software across U.S. government programs.

## Fewer CVEs, more accurate findings: Wiz now scans Chainguard Libraries for Python and Java

DevFeed: [Fewer CVEs, more accurate findings: Wiz now scans Chainguard Libraries for Python and Java](<https://devfeed.tech/articles/fewer-cves-more-accurate-findings-wiz-now-scans-chainguard-libraries-for-python-and-java-13335.md>)

Original publisher: [Read original article](<https://www.chainguard.dev/unchained/wiz-now-scans-chainguard-libraries-for-python-and-java>)

Published: 2026-06-25T00:00:00Z

Content type: release

Language: en

Sources: [Chainguard: Unchained](<https://devfeed.tech/sources/chainguard-unchained.md>)

Topics: [chainguard](<https://devfeed.tech/topics/chainguard.md>), [chainguard libraries](<https://devfeed.tech/topics/chainguard-libraries.md>), [chainguard libraries for python](<https://devfeed.tech/topics/chainguard-libraries-for-python.md>), [Java](<https://devfeed.tech/topics/java.md>), [supply-chain-security](<https://devfeed.tech/topics/supply-chain-security.md>), [Security](<https://devfeed.tech/topics/security.md>)

Tags: [chainguard](<https://devfeed.tech/tags/chainguard.md>), [chainguard-libraries](<https://devfeed.tech/tags/chainguard-libraries.md>), [chainguard-libraries-for-java](<https://devfeed.tech/tags/chainguard-libraries-for-java.md>), [chainguard-libraries-for-python](<https://devfeed.tech/tags/chainguard-libraries-for-python.md>), [cves](<https://devfeed.tech/tags/cves.md>), [dependencies](<https://devfeed.tech/tags/dependencies.md>), [java](<https://devfeed.tech/tags/java.md>), [provenance](<https://devfeed.tech/tags/provenance.md>), [python](<https://devfeed.tech/tags/python.md>), [security](<https://devfeed.tech/tags/security.md>), [software-supply-chain](<https://devfeed.tech/tags/software-supply-chain.md>), [supply-chain](<https://devfeed.tech/tags/supply-chain.md>), [wiz](<https://devfeed.tech/tags/wiz.md>), [wiz-chainguard-libraries](<https://devfeed.tech/tags/wiz-chainguard-libraries.md>), [wiz-chainguard-scanner](<https://devfeed.tech/tags/wiz-chainguard-scanner.md>)

### AI overview

Wiz now scans Chainguard Libraries for Python and Java. The partnership combines source-built dependencies and backported fixes with Wiz's risk context and visibility, helping organizations assess vulnerabilities, prioritize remediation, and verify artifact provenance.

### Source excerpt

Wiz now scans Chainguard Libraries for Python and Java, combining trusted, source-built dependencies with risk-based visibility and remediation.

## Everything we announced during AI Readiness Innovation Week

DevFeed: [Everything we announced during AI Readiness Innovation Week](<https://devfeed.tech/articles/everything-we-announced-during-ai-readiness-innovation-week-13033.md>)

Original publisher: [Read original article](<https://www.chainguard.dev/unchained/everything-we-announced-during-ai-readiness-innovation-week>)

Published: 2026-06-25T00:00:00Z

Content type: article

Language: en

Sources: [Chainguard: Unchained](<https://devfeed.tech/sources/chainguard-unchained.md>)

Topics: [Artificial Intelligence](<https://devfeed.tech/topics/ai.md>), [ai-coding](<https://devfeed.tech/topics/ai-coding.md>), [supply-chain-security](<https://devfeed.tech/topics/supply-chain-security.md>), [chainguard](<https://devfeed.tech/topics/chainguard.md>), [open-source-security](<https://devfeed.tech/topics/open-source-security.md>), [Vulnerabilities](<https://devfeed.tech/topics/vulnerabilities.md>), [Security](<https://devfeed.tech/topics/security.md>), [chainguard libraries](<https://devfeed.tech/topics/chainguard-libraries.md>), [chainguard containers](<https://devfeed.tech/topics/chainguard-containers.md>), [CI/CD](<https://devfeed.tech/topics/cicd.md>), [Frontier AI](<https://devfeed.tech/topics/frontier-ai.md>), [GitHub](<https://devfeed.tech/topics/github.md>)

Tags: [ai](<https://devfeed.tech/tags/ai.md>), [ai-readiness](<https://devfeed.tech/tags/ai-readiness.md>), [athena](<https://devfeed.tech/tags/athena.md>), [aws-kiro](<https://devfeed.tech/tags/aws-kiro.md>), [chainguard](<https://devfeed.tech/tags/chainguard.md>), [chainguard-containers](<https://devfeed.tech/tags/chainguard-containers.md>), [chainguard-libraries](<https://devfeed.tech/tags/chainguard-libraries.md>), [ci-cd](<https://devfeed.tech/tags/ci-cd.md>), [containers](<https://devfeed.tech/tags/containers.md>), [cursor](<https://devfeed.tech/tags/cursor.md>), [frontier-ai-models](<https://devfeed.tech/tags/frontier-ai-models.md>), [gartner-magic-quadrant](<https://devfeed.tech/tags/gartner-magic-quadrant.md>), [github](<https://devfeed.tech/tags/github.md>), [innovation](<https://devfeed.tech/tags/innovation.md>), [open-source](<https://devfeed.tech/tags/open-source.md>), [security](<https://devfeed.tech/tags/security.md>), [software-supply-chain](<https://devfeed.tech/tags/software-supply-chain.md>), [software-supply-chain-security](<https://devfeed.tech/tags/software-supply-chain-security.md>), [speed](<https://devfeed.tech/tags/speed.md>), [vulnerabilities](<https://devfeed.tech/tags/vulnerabilities.md>)

### AI overview

Chainguard summarizes announcements from AI Readiness Innovation Week, covering supply-chain security advances for containers, libraries, CI/CD pipelines, AI agent skills, IDE integrations, partnerships, and an industry coalition. The article highlights Athena, a coalition designed to coordinate defense against vulnerabilities discovered by frontier AI models.

### Source excerpt

Read about everything Chainguard announced during AI Readiness Innovation Week, including new features for Chainguard Libraries and Chainguard Containers.

## Chainguard Libraries for Java is now GA; CVE remediation beta available for sign up

DevFeed: [Chainguard Libraries for Java is now GA; CVE remediation beta available for sign up](<https://devfeed.tech/articles/chainguard-libraries-for-java-is-now-ga-cve-remediation-beta-available-for-sign-up-12966.md>)

Original publisher: [Read original article](<https://www.chainguard.dev/unchained/chainguard-libraries-for-java-is-now-ga-and-includes-cve-remediation>)

Published: 2026-06-23T00:00:00Z

Content type: release

Language: en

Sources: [Chainguard: Unchained](<https://devfeed.tech/sources/chainguard-unchained.md>)

Topics: [chainguard libraries](<https://devfeed.tech/topics/chainguard-libraries.md>), [Java](<https://devfeed.tech/topics/java.md>), [Spring Boot](<https://devfeed.tech/topics/spring-boot.md>), [Security](<https://devfeed.tech/topics/security.md>), [Back end](<https://devfeed.tech/topics/backend.md>)

Tags: [chainguard](<https://devfeed.tech/tags/chainguard.md>), [chainguard-libraries](<https://devfeed.tech/tags/chainguard-libraries.md>), [chainguard-libraries-for-java](<https://devfeed.tech/tags/chainguard-libraries-for-java.md>), [cve](<https://devfeed.tech/tags/cve.md>), [cve-remediation](<https://devfeed.tech/tags/cve-remediation.md>), [dependencies](<https://devfeed.tech/tags/dependencies.md>), [java](<https://devfeed.tech/tags/java.md>), [java-packages](<https://devfeed.tech/tags/java-packages.md>), [java-spring](<https://devfeed.tech/tags/java-spring.md>), [open-source](<https://devfeed.tech/tags/open-source.md>), [provenance](<https://devfeed.tech/tags/provenance.md>), [sboms](<https://devfeed.tech/tags/sboms.md>), [scanner](<https://devfeed.tech/tags/scanner.md>), [security](<https://devfeed.tech/tags/security.md>), [zero-cve-packages](<https://devfeed.tech/tags/zero-cve-packages.md>)

### AI overview

Chainguard Libraries for Java is generally available, and its CVE remediation capability is available in beta. The article describes backported fixes for critical and high-severity CVEs across the Spring Boot ecosystem, helping teams manage risks in pinned or legacy Java dependencies while planning upgrades.

### Source excerpt

Chainguard Libraries for Java is now GA, delivering CVE-remediated dependencies with SBOMs, provenance, and scanner-recognized fixes.

## Building a category: Chainguard named a Leader in the inaugural Gartner® Magic Quadrant™ for Software Supply Chain Security

DevFeed: [Building a category: Chainguard named a Leader in the inaugural Gartner® Magic Quadrant™ for Software Supply Chain Security](<https://devfeed.tech/articles/building-a-category-chainguard-named-a-leader-in-the-inaugural-gartner-magic-quadranttm-for-software-supply-chain-security-12901.md>)

Original publisher: [Read original article](<https://www.chainguard.dev/unchained/building-a-category-chainguard-named-a-leader-in-the-inaugural-gartner-magic-quadrant-for-software-supply-chain-security>)

Published: 2026-06-22T00:00:00Z

Content type: article

Language: en

Sources: [Chainguard: Unchained](<https://devfeed.tech/sources/chainguard-unchained.md>)

Topics: [supply-chain-security](<https://devfeed.tech/topics/supply-chain-security.md>), [chainguard containers](<https://devfeed.tech/topics/chainguard-containers.md>), [container images](<https://devfeed.tech/topics/container-images.md>), [Security](<https://devfeed.tech/topics/security.md>), [Containers](<https://devfeed.tech/topics/containers.md>), [chainguard libraries](<https://devfeed.tech/topics/chainguard-libraries.md>)

Tags: [chainguard](<https://devfeed.tech/tags/chainguard.md>), [chainguard-containers](<https://devfeed.tech/tags/chainguard-containers.md>), [chainguard-gartner](<https://devfeed.tech/tags/chainguard-gartner.md>), [chainguard-gartner-mq](<https://devfeed.tech/tags/chainguard-gartner-mq.md>), [chainguard-libraries](<https://devfeed.tech/tags/chainguard-libraries.md>), [container-images](<https://devfeed.tech/tags/container-images.md>), [gartner](<https://devfeed.tech/tags/gartner.md>), [gartner-magic-quadrant](<https://devfeed.tech/tags/gartner-magic-quadrant.md>), [sboms](<https://devfeed.tech/tags/sboms.md>), [secure-by-default](<https://devfeed.tech/tags/secure-by-default.md>), [security](<https://devfeed.tech/tags/security.md>), [software-supply-chain-security](<https://devfeed.tech/tags/software-supply-chain-security.md>), [software-supply-chain-security-gartner](<https://devfeed.tech/tags/software-supply-chain-security-gartner.md>), [software-supply-chain-security-mq](<https://devfeed.tech/tags/software-supply-chain-security-mq.md>), [zero-cves](<https://devfeed.tech/tags/zero-cves.md>)

### AI overview

Chainguard's article discusses its recognition as a Leader in Gartner's inaugural Magic Quadrant for Software Supply Chain Security. It argues that accelerating vulnerability exploitation and AI-assisted development require prevention-oriented, secure-by-default supply chain security. The article highlights Chainguard Containers, which provides minimal container images rebuilt daily from source, with zero CVEs, SBOMs, and verifiable signatures, and briefly introduces Chainguard Libraries.

### Source excerpt

Gartner names Chainguard a Leader in Software Supply Chain Security, highlighting its secure-by-default approach and market vision.

## Miasma Phantom Gyp npm attack: 57 packages, 286 malicious versions hijack CI/CD pipelines via binding.gyp

DevFeed: [Miasma Phantom Gyp npm attack: 57 packages, 286 malicious versions hijack CI/CD pipelines via binding.gyp](<https://devfeed.tech/articles/miasma-phantom-gyp-npm-attack-57-packages-286-malicious-versions-hijack-ci-cd-pipelines-via-binding-gyp-12928.md>)

Original publisher: [Read original article](<https://www.chainguard.dev/unchained/chainguard-artifacts-safe-from-miasma-phantom-gyp-npm-attack>)

Published: 2026-06-05T00:00:00Z

Content type: article

Language: en

Sources: [Chainguard: Unchained](<https://devfeed.tech/sources/chainguard-unchained.md>)

Topics: [npm packages](<https://devfeed.tech/topics/npm-packages.md>), [Malware](<https://devfeed.tech/topics/malware.md>), [Security](<https://devfeed.tech/topics/security.md>), [CI/CD](<https://devfeed.tech/topics/cicd.md>), [npm](<https://devfeed.tech/topics/npm.md>), [chainguard libraries](<https://devfeed.tech/topics/chainguard-libraries.md>), [chainguard](<https://devfeed.tech/topics/chainguard.md>)

Tags: [chainguard](<https://devfeed.tech/tags/chainguard.md>), [chainguard-actions](<https://devfeed.tech/tags/chainguard-actions.md>), [chainguard-containers](<https://devfeed.tech/tags/chainguard-containers.md>), [chainguard-libraries](<https://devfeed.tech/tags/chainguard-libraries.md>), [ci-cd](<https://devfeed.tech/tags/ci-cd.md>), [malware](<https://devfeed.tech/tags/malware.md>), [miasma](<https://devfeed.tech/tags/miasma.md>), [npm-security](<https://devfeed.tech/tags/npm-security.md>), [packages](<https://devfeed.tech/tags/packages.md>), [phantom-gyp](<https://devfeed.tech/tags/phantom-gyp.md>), [shai-hulud](<https://devfeed.tech/tags/shai-hulud.md>), [supply-chain](<https://devfeed.tech/tags/supply-chain.md>)

### AI overview

This article describes the Miasma Phantom Gyp npm supply-chain attack, in which attackers published 286 malicious versions across 57 packages. The self-replicating worm targeted CI/CD pipelines, harvested credentials, poisoned additional packages, modified workflows, and planted backdoor configurations in AI coding assistant directories. It also explains that Chainguard customers were protected because Chainguard Libraries builds from source and blocked the malicious versions.

### Source excerpt

A new npm supply chain worm compromised 57 packages and 286 versions. Learn how Chainguard blocked the attack and protected customers by design.

## Chainguard and Upwind: Secure what you build. Verify what you run.

DevFeed: [Chainguard and Upwind: Secure what you build. Verify what you run.](<https://devfeed.tech/articles/chainguard-and-upwind-secure-what-you-build-verify-what-you-run-12926.md>)

Original publisher: [Read original article](<https://www.chainguard.dev/unchained/chainguard-and-upwind-secure-what-you-build-verify-what-you-run>)

Published: 2026-05-26T00:00:00Z

Content type: release

Language: en

Sources: [Chainguard: Unchained](<https://devfeed.tech/sources/chainguard-unchained.md>)

Topics: [chainguard](<https://devfeed.tech/topics/chainguard.md>), [chainguard libraries](<https://devfeed.tech/topics/chainguard-libraries.md>), [supply-chain-security](<https://devfeed.tech/topics/supply-chain-security.md>), [malicious packages](<https://devfeed.tech/topics/malicious-packages.md>), [Application Security](<https://devfeed.tech/topics/application-security.md>), [Vulnerabilities](<https://devfeed.tech/topics/vulnerabilities.md>)

Tags: [application-security](<https://devfeed.tech/tags/application-security.md>), [chainguard](<https://devfeed.tech/tags/chainguard.md>), [chainguard-libraries](<https://devfeed.tech/tags/chainguard-libraries.md>), [chainguard-libraries-for-python](<https://devfeed.tech/tags/chainguard-libraries-for-python.md>), [chainguard-scanners](<https://devfeed.tech/tags/chainguard-scanners.md>), [chainguard-upwind](<https://devfeed.tech/tags/chainguard-upwind.md>), [cybersecurity](<https://devfeed.tech/tags/cybersecurity.md>), [malicious-packages](<https://devfeed.tech/tags/malicious-packages.md>), [malware-scanners](<https://devfeed.tech/tags/malware-scanners.md>), [security](<https://devfeed.tech/tags/security.md>), [supply-chain-attacks](<https://devfeed.tech/tags/supply-chain-attacks.md>), [upwind](<https://devfeed.tech/tags/upwind.md>), [vulnerabilities](<https://devfeed.tech/tags/vulnerabilities.md>)

### AI overview

Chainguard announces that Upwind now scans Chainguard Libraries for Python. The article describes combining trusted software artifacts with runtime visibility to reduce noise and supply chain risk.

### Source excerpt

Chainguard and Upwind combine trusted, source-built artifacts with runtime verification to cut noise, reduce risk, and secure AI-era software.

## How does Chainguard prevent malware in Chainguard Libraries?

DevFeed: [How does Chainguard prevent malware in Chainguard Libraries?](<https://devfeed.tech/articles/how-does-chainguard-prevent-malware-in-chainguard-libraries-13088.md>)

Original publisher: [Read original article](<https://www.chainguard.dev/unchained/how-does-chainguard-prevent-malware-in-chainguard-libraries>)

Published: 2026-05-01T00:00:00Z

Content type: article

Language: en

Sources: [Chainguard: Unchained](<https://devfeed.tech/sources/chainguard-unchained.md>)

Topics: [chainguard libraries](<https://devfeed.tech/topics/chainguard-libraries.md>), [Malware](<https://devfeed.tech/topics/malware.md>), [supply-chain-security](<https://devfeed.tech/topics/supply-chain-security.md>), [chainguard](<https://devfeed.tech/topics/chainguard.md>), [Open Source](<https://devfeed.tech/topics/open-source.md>), [Artificial Intelligence](<https://devfeed.tech/topics/ai.md>)

Tags: [ai](<https://devfeed.tech/tags/ai.md>), [chainguard](<https://devfeed.tech/tags/chainguard.md>), [chainguard-libraries](<https://devfeed.tech/tags/chainguard-libraries.md>), [malware](<https://devfeed.tech/tags/malware.md>), [open-source](<https://devfeed.tech/tags/open-source.md>), [software-supply-chain](<https://devfeed.tech/tags/software-supply-chain.md>), [supply-chain](<https://devfeed.tech/tags/supply-chain.md>)

### AI overview

Chainguard explains how Chainguard Libraries protects customers from malware in open source dependencies by building packages from source in a controlled environment. The article describes binary artifacts without corresponding source code as a common supply-chain attack vector and highlights Chainguard's AI-powered Factory for reproducing packages at scale.

### Source excerpt

With Chainguard Libraries, customers rely on a single controlled, auditable system.

## Chainguard customers safe from elementary-data compromise

DevFeed: [Chainguard customers safe from elementary-data compromise](<https://devfeed.tech/articles/chainguard-customers-safe-from-elementary-data-compromise-12937.md>)

Original publisher: [Read original article](<https://www.chainguard.dev/unchained/chainguard-customers-safe-from-elementary-data-compromise>)

Published: 2026-04-25T00:00:00Z

Content type: article

Language: en

Sources: [Chainguard: Unchained](<https://devfeed.tech/sources/chainguard-unchained.md>)

Topics: [chainguard](<https://devfeed.tech/topics/chainguard.md>), [Malware](<https://devfeed.tech/topics/malware.md>), [data observability](<https://devfeed.tech/topics/data-observability.md>), [Data Quality](<https://devfeed.tech/topics/data-quality.md>), [chainguard containers](<https://devfeed.tech/topics/chainguard-containers.md>), [chainguard libraries](<https://devfeed.tech/topics/chainguard-libraries.md>)

Tags: [chainguard](<https://devfeed.tech/tags/chainguard.md>), [chainguard-containers](<https://devfeed.tech/tags/chainguard-containers.md>), [chainguard-customers](<https://devfeed.tech/tags/chainguard-customers.md>), [chainguard-libraries](<https://devfeed.tech/tags/chainguard-libraries.md>), [data-observability](<https://devfeed.tech/tags/data-observability.md>), [data-quality](<https://devfeed.tech/tags/data-quality.md>), [elementary-data-compromise](<https://devfeed.tech/tags/elementary-data-compromise.md>), [malware](<https://devfeed.tech/tags/malware.md>), [pypi](<https://devfeed.tech/tags/pypi.md>), [pypi-malware](<https://devfeed.tech/tags/pypi-malware.md>)

### AI overview

Chainguard reports that customers using its Python Libraries and Container images were unaffected by the compromised elementary-data 0.23.3 package on PyPI. Chainguard detected malicious patterns before building the package, while the compromised release was quarantined and related GitHub and Docker artifacts were removed.

### Source excerpt

Malicious elementary-data version hit PyPI. Chainguard customers stayed protected by detecting malware pre-build and serving only verified safe versions.

## Chainguard customers safe from new npm worm and xinference supply chain attack

DevFeed: [Chainguard customers safe from new npm worm and xinference supply chain attack](<https://devfeed.tech/articles/chainguard-customers-safe-from-new-npm-worm-and-xinference-supply-chain-attack-12939.md>)

Original publisher: [Read original article](<https://www.chainguard.dev/unchained/chainguard-customers-safe-from-new-npm-worm-and-xinference-supply-chain-attack>)

Published: 2026-04-22T00:00:00Z

Content type: article

Language: en

Sources: [Chainguard: Unchained](<https://devfeed.tech/sources/chainguard-unchained.md>)

Topics: [chainguard](<https://devfeed.tech/topics/chainguard.md>), [Malware](<https://devfeed.tech/topics/malware.md>), [npm](<https://devfeed.tech/topics/npm.md>), [Credential theft](<https://devfeed.tech/topics/credential-theft.md>), [Library](<https://devfeed.tech/topics/library.md>), [chainguard libraries](<https://devfeed.tech/topics/chainguard-libraries.md>), [chainguard containers](<https://devfeed.tech/topics/chainguard-containers.md>), [GitHub](<https://devfeed.tech/topics/github.md>)

Tags: [chainguard](<https://devfeed.tech/tags/chainguard.md>), [chainguard-containers](<https://devfeed.tech/tags/chainguard-containers.md>), [chainguard-libraries](<https://devfeed.tech/tags/chainguard-libraries.md>), [chainguard-malware](<https://devfeed.tech/tags/chainguard-malware.md>), [credential-theft](<https://devfeed.tech/tags/credential-theft.md>), [github](<https://devfeed.tech/tags/github.md>), [malicious-packages](<https://devfeed.tech/tags/malicious-packages.md>), [malware](<https://devfeed.tech/tags/malware.md>), [npm](<https://devfeed.tech/tags/npm.md>), [npm-malware](<https://devfeed.tech/tags/npm-malware.md>), [npm-worm](<https://devfeed.tech/tags/npm-worm.md>), [packages](<https://devfeed.tech/tags/packages.md>), [pypi-malware](<https://devfeed.tech/tags/pypi-malware.md>), [supply-chain](<https://devfeed.tech/tags/supply-chain.md>), [worm](<https://devfeed.tech/tags/worm.md>), [xinference](<https://devfeed.tech/tags/xinference.md>)

### AI overview

The article reports npm and PyPI malware attacks affecting 25 packages with more than 60,000 combined monthly downloads. It explains that Chainguard customers were protected because Chainguard builds from verifiable source code and rejects packages that rely on install-time scripts.

### Source excerpt

New npm and PyPI malware hit many popular packages. Chainguard customers stayed protected by blocking install scripts and rebuilding only verified source code.

## Chainguard and Cursor partner to bring secure open source artifacts to agentic coding

DevFeed: [Chainguard and Cursor partner to bring secure open source artifacts to agentic coding](<https://devfeed.tech/articles/chainguard-and-cursor-partner-to-bring-secure-open-source-artifacts-to-agentic-coding-12924.md>)

Original publisher: [Read original article](<https://www.chainguard.dev/unchained/chainguard-and-cursor-partner-to-bring-secure-open-source-artifacts-to-agentic-coding>)

Published: 2026-04-21T00:00:00Z

Content type: release

Language: en

Sources: [Chainguard: Unchained](<https://devfeed.tech/sources/chainguard-unchained.md>)

Topics: [agentic-coding](<https://devfeed.tech/topics/agentic-coding.md>), [cursor](<https://devfeed.tech/topics/cursor.md>), [chainguard containers](<https://devfeed.tech/topics/chainguard-containers.md>), [chainguard libraries](<https://devfeed.tech/topics/chainguard-libraries.md>), [Security](<https://devfeed.tech/topics/security.md>), [Open Source](<https://devfeed.tech/topics/open-source.md>), [ai-coding](<https://devfeed.tech/topics/ai-coding.md>)

Tags: [agentic-coding](<https://devfeed.tech/tags/agentic-coding.md>), [ai-agents](<https://devfeed.tech/tags/ai-agents.md>), [chainguard](<https://devfeed.tech/tags/chainguard.md>), [chainguard-containers](<https://devfeed.tech/tags/chainguard-containers.md>), [chainguard-cursor-partnership](<https://devfeed.tech/tags/chainguard-cursor-partnership.md>), [chainguard-libraries](<https://devfeed.tech/tags/chainguard-libraries.md>), [cursor](<https://devfeed.tech/tags/cursor.md>), [open-source](<https://devfeed.tech/tags/open-source.md>), [secure-open-source](<https://devfeed.tech/tags/secure-open-source.md>), [security](<https://devfeed.tech/tags/security.md>), [shai-hulud](<https://devfeed.tech/tags/shai-hulud.md>), [supply-chain](<https://devfeed.tech/tags/supply-chain.md>)

### AI overview

Chainguard and Cursor are partnering to provide trusted, secure open source containers and libraries for agentic coding. The integration directs developers away from insecure public registries toward Chainguard Repository artifacts, helping reduce malware and software supply chain risks without slowing development.

### Source excerpt

Chainguard and Cursor partner to secure AI-generated code with trusted, source-built containers and libraries, reducing risk without slowing developers.

## Chainguard Libraries is now free until June 30, 2026 -- no commitment required

DevFeed: [Chainguard Libraries is now free until June 30, 2026 -- no commitment required](<https://devfeed.tech/articles/chainguard-libraries-is-now-free-until-june-30-2026-no-commitment-required-12968.md>)

Original publisher: [Read original article](<https://www.chainguard.dev/unchained/chainguard-libraries-is-now-free-until-june-30-2026-no-commitment-required>)

Published: 2026-04-09T00:00:00Z

Content type: release

Language: en

Sources: [Chainguard: Unchained](<https://devfeed.tech/sources/chainguard-unchained.md>)

Topics: [chainguard libraries](<https://devfeed.tech/topics/chainguard-libraries.md>), [open-source-security](<https://devfeed.tech/topics/open-source-security.md>), [Security](<https://devfeed.tech/topics/security.md>), [Malware](<https://devfeed.tech/topics/malware.md>), [Java](<https://devfeed.tech/topics/java.md>), [JavaScript](<https://devfeed.tech/topics/javascript.md>), [Python](<https://devfeed.tech/topics/python.md>)

Tags: [2026](<https://devfeed.tech/tags/2026.md>), [article](<https://devfeed.tech/tags/article.md>), [attacks](<https://devfeed.tech/tags/attacks.md>), [axios](<https://devfeed.tech/tags/axios.md>), [chainguard-console](<https://devfeed.tech/tags/chainguard-console.md>), [chainguard-libraries](<https://devfeed.tech/tags/chainguard-libraries.md>), [chainguard-repository](<https://devfeed.tech/tags/chainguard-repository.md>), [code](<https://devfeed.tech/tags/code.md>), [dependency](<https://devfeed.tech/tags/dependency.md>), [free](<https://devfeed.tech/tags/free.md>), [install](<https://devfeed.tech/tags/install.md>), [java](<https://devfeed.tech/tags/java.md>), [javascript](<https://devfeed.tech/tags/javascript.md>), [libraries](<https://devfeed.tech/tags/libraries.md>), [library](<https://devfeed.tech/tags/library.md>), [litellm](<https://devfeed.tech/tags/litellm.md>), [malicious-packages](<https://devfeed.tech/tags/malicious-packages.md>), [malware](<https://devfeed.tech/tags/malware.md>), [open-source](<https://devfeed.tech/tags/open-source.md>), [open-source-packages](<https://devfeed.tech/tags/open-source-packages.md>), [open-source-security](<https://devfeed.tech/tags/open-source-security.md>), [packages](<https://devfeed.tech/tags/packages.md>), [rebuilds](<https://devfeed.tech/tags/rebuilds.md>), [software-supply-chain-security](<https://devfeed.tech/tags/software-supply-chain-security.md>), [telnyx](<https://devfeed.tech/tags/telnyx.md>), [trivy-attack](<https://devfeed.tech/tags/trivy-attack.md>)

### AI overview

Chainguard Libraries is free for Chainguard console users until June 30, 2026, with no paid commitment required. It rebuilds Python, Java, and JavaScript packages from verified source in isolated environments and excludes libraries that use install-time scripts, helping reduce malware and software supply-chain risk.

### Source excerpt

Open source attacks are rising. Chainguard Libraries rebuilds packages from verified source to block malware--now free until June 30, 2026.

## The litellm PyPI compromise and how Chainguard Libraries blocked malicious releases

DevFeed: [The litellm PyPI compromise and how Chainguard Libraries blocked malicious releases](<https://devfeed.tech/articles/you-were-one-pip-install-away-from-the-litellm-breach-chainguard-customers-weren-t-13344.md>)

Original publisher: [Read original article](<https://www.chainguard.dev/unchained/you-were-one-pip-install-away-from-a-breach-chainguard-customers-werent>)

Published: 2026-03-24T00:00:00Z

Content type: article

Language: en

Sources: [Chainguard: Unchained](<https://devfeed.tech/sources/chainguard-unchained.md>)

Topics: [litellm](<https://devfeed.tech/topics/litellm.md>), [chainguard libraries](<https://devfeed.tech/topics/chainguard-libraries.md>), [open-source-security](<https://devfeed.tech/topics/open-source-security.md>)

Tags: [chainguard-libraries](<https://devfeed.tech/tags/chainguard-libraries.md>), [chainguard-libraries-for-python](<https://devfeed.tech/tags/chainguard-libraries-for-python.md>), [litellm](<https://devfeed.tech/tags/litellm.md>), [litellm-attack](<https://devfeed.tech/tags/litellm-attack.md>), [litellm-package](<https://devfeed.tech/tags/litellm-package.md>), [litellm-supply-chain-attack](<https://devfeed.tech/tags/litellm-supply-chain-attack.md>), [open-source-security](<https://devfeed.tech/tags/open-source-security.md>), [pypi](<https://devfeed.tech/tags/pypi.md>), [secure-packages](<https://devfeed.tech/tags/secure-packages.md>), [security](<https://devfeed.tech/tags/security.md>), [supply-chain-attacks](<https://devfeed.tech/tags/supply-chain-attacks.md>)

### AI overview

The article describes a litellm compromise on PyPI in which malicious releases were used to steal secrets. It states that Chainguard Libraries prevented exposure by rebuilding only verified source and blocking the malicious releases.

### Source excerpt

Hackers compromised litellm on PyPI to steal secrets. Chainguard Libraries prevented exposure by rebuilding only verified source, blocking malicious releases.

## Why Backporting Python Security Fixes Is Complex and Risky

DevFeed: [Why Backporting Python Security Fixes Is Complex and Risky](<https://devfeed.tech/articles/this-shit-is-hard-the-complexities-of-fixing-python-library-security-issues-at-scale-13290.md>)

Original publisher: [Read original article](<https://www.chainguard.dev/unchained/this-shit-is-hard-the-complexities-of-fixing-python-library-security-issues-at-scale>)

Published: 2026-02-27T00:00:00Z

Content type: opinion

Language: en

Sources: [Chainguard: Unchained](<https://devfeed.tech/sources/chainguard-unchained.md>)

Topics: [Python](<https://devfeed.tech/topics/python.md>), [Security](<https://devfeed.tech/topics/security.md>), [Vulnerabilities](<https://devfeed.tech/topics/vulnerabilities.md>), [chainguard libraries](<https://devfeed.tech/topics/chainguard-libraries.md>)

Tags: [chainguard-libraries](<https://devfeed.tech/tags/chainguard-libraries.md>), [cve](<https://devfeed.tech/tags/cve.md>), [dependency](<https://devfeed.tech/tags/dependency.md>), [machine-learning](<https://devfeed.tech/tags/machine-learning.md>), [python](<https://devfeed.tech/tags/python.md>), [python-dependencies](<https://devfeed.tech/tags/python-dependencies.md>), [python-libraries](<https://devfeed.tech/tags/python-libraries.md>), [python-packages](<https://devfeed.tech/tags/python-packages.md>), [secure-software](<https://devfeed.tech/tags/secure-software.md>), [security](<https://devfeed.tech/tags/security.md>), [vulnerabilities](<https://devfeed.tech/tags/vulnerabilities.md>), [zero-cve-python-libraries](<https://devfeed.tech/tags/zero-cve-python-libraries.md>)

### AI overview

The article explains why updating vulnerable Python dependencies can be difficult when compatibility constraints prevent immediate upgrades. It argues that manually backporting security patches is complex, time-consuming, and risky, and presents Chainguard Libraries as a source of tested and verified patched packages.

### Source excerpt

Backporting Python CVE fixes is complex and risky. Chainguard Libraries delivers source-built, tested, and verified patched packages you can trust.

## npm Token Changes Improve Supply-Chain Security but MFA Phishing and Bypass Tokens Remain Risks

DevFeed: [npm Token Changes Improve Supply-Chain Security but MFA Phishing and Bypass Tokens Remain Risks](<https://devfeed.tech/articles/npm-s-update-to-harden-their-supply-chain-and-points-to-consider-13191.md>)

Original publisher: [Read original article](<https://www.chainguard.dev/unchained/npm-update-to-harden-their-supply-chain-and-points-to-consider>)

Published: 2026-02-03T00:00:00Z

Content type: article

Language: en

Sources: [Chainguard: Unchained](<https://devfeed.tech/sources/chainguard-unchained.md>)

Topics: [npm](<https://devfeed.tech/topics/npm.md>), [Security](<https://devfeed.tech/topics/security.md>), [MFA](<https://devfeed.tech/topics/mfa.md>), [Malware](<https://devfeed.tech/topics/malware.md>), [OpenID connect (OIDC)](<https://devfeed.tech/topics/oidc.md>), [chainguard libraries](<https://devfeed.tech/topics/chainguard-libraries.md>)

Tags: [chainguard](<https://devfeed.tech/tags/chainguard.md>), [chainguard-libraries](<https://devfeed.tech/tags/chainguard-libraries.md>), [chainguard-libraries-for-javascript](<https://devfeed.tech/tags/chainguard-libraries-for-javascript.md>), [javascript-packages](<https://devfeed.tech/tags/javascript-packages.md>), [malware](<https://devfeed.tech/tags/malware.md>), [mfa](<https://devfeed.tech/tags/mfa.md>), [npm](<https://devfeed.tech/tags/npm.md>), [oidc](<https://devfeed.tech/tags/oidc.md>), [phishing](<https://devfeed.tech/tags/phishing.md>), [secure-packages](<https://devfeed.tech/tags/secure-packages.md>), [supply-chain](<https://devfeed.tech/tags/supply-chain.md>), [supply-chain-attacks](<https://devfeed.tech/tags/supply-chain-attacks.md>)

### AI overview

The article examines npm's authentication overhaul after the Sha1-Hulud incident. It explains that short-lived session tokens, default MFA for publishing, and OIDC Trusted Publishing improve security, but MFA phishing and optional 90-day tokens with MFA bypass still leave projects vulnerable to supply-chain attacks.

### Source excerpt

npm's token changes help, but MFA phishing and optional bypass tokens still enable supply-chain attacks. Source-built Chainguard Libraries reduce the risk.

## Introducing automatic, short-lived credentials for Chainguard Libraries for Python

DevFeed: [Introducing automatic, short-lived credentials for Chainguard Libraries for Python](<https://devfeed.tech/articles/introducing-automatic-short-lived-credentials-for-chainguard-libraries-for-python-13105.md>)

Original publisher: [Read original article](<https://www.chainguard.dev/unchained/introducing-automatic-short-lived-credentials-for-chainguard-libraries-for-python>)

Published: 2026-01-15T00:00:00Z

Content type: article

Language: en

Sources: [Chainguard: Unchained](<https://devfeed.tech/sources/chainguard-unchained.md>)

Topics: [chainguard libraries for python](<https://devfeed.tech/topics/chainguard-libraries-for-python.md>), [chainguard libraries](<https://devfeed.tech/topics/chainguard-libraries.md>), [Authentication](<https://devfeed.tech/topics/authentication.md>), [pip](<https://devfeed.tech/topics/pip.md>), [developer velocity](<https://devfeed.tech/topics/developer-velocity.md>), [Usability](<https://devfeed.tech/topics/usability.md>)

Tags: [authentication](<https://devfeed.tech/tags/authentication.md>), [chainguard-libraries](<https://devfeed.tech/tags/chainguard-libraries.md>), [chainguard-libraries-for-python](<https://devfeed.tech/tags/chainguard-libraries-for-python.md>), [chainguard-libraries-python](<https://devfeed.tech/tags/chainguard-libraries-python.md>), [chainguard-packages](<https://devfeed.tech/tags/chainguard-packages.md>), [chainguard-python-containers](<https://devfeed.tech/tags/chainguard-python-containers.md>), [developer-velocity](<https://devfeed.tech/tags/developer-velocity.md>), [github-actions](<https://devfeed.tech/tags/github-actions.md>), [pypi](<https://devfeed.tech/tags/pypi.md>), [python-libraries](<https://devfeed.tech/tags/python-libraries.md>), [python-packages](<https://devfeed.tech/tags/python-packages.md>), [secure-python-packages](<https://devfeed.tech/tags/secure-python-packages.md>), [security](<https://devfeed.tech/tags/security.md>), [usability](<https://devfeed.tech/tags/usability.md>)

### AI overview

Chainguard announces integrated authentication for Chainguard Libraries for Python through a keyring package. The package provides short-lived credentials that refresh automatically, enabling secure pip access without repeatedly creating, copying, or managing long-lived tokens. It supports local development and GitHub Actions environments with assumable identities.

### Source excerpt

New integrated authentication for Python Libraries with a keyring: use short-lived credentials for pip installs to stay secure without slowing developers down.

## What's new in December 2025: exploring new Chainguard product features

DevFeed: [What's new in December 2025: exploring new Chainguard product features](<https://devfeed.tech/articles/what-s-new-in-december-2025-exploring-new-chainguard-product-features-13322.md>)

Original publisher: [Read original article](<https://www.chainguard.dev/unchained/whats-new-in-december-2025>)

Published: 2025-12-09T00:00:00Z

Content type: release

Language: en

Sources: [Chainguard: Unchained](<https://devfeed.tech/sources/chainguard-unchained.md>)

Topics: [chainguard](<https://devfeed.tech/topics/chainguard.md>), [chainguard containers](<https://devfeed.tech/topics/chainguard-containers.md>), [chainguard libraries](<https://devfeed.tech/topics/chainguard-libraries.md>), [releases](<https://devfeed.tech/topics/releases.md>), [open-source-security](<https://devfeed.tech/topics/open-source-security.md>), [Cloud Native Ecosystem](<https://devfeed.tech/topics/cloud-native-ecosystem.md>)

Tags: [2025](<https://devfeed.tech/tags/2025.md>), [chainguard](<https://devfeed.tech/tags/chainguard.md>), [chainguard-containers](<https://devfeed.tech/tags/chainguard-containers.md>), [chainguard-latest-releases](<https://devfeed.tech/tags/chainguard-latest-releases.md>), [chainguard-libraries](<https://devfeed.tech/tags/chainguard-libraries.md>), [chainguard-vms](<https://devfeed.tech/tags/chainguard-vms.md>), [integrations](<https://devfeed.tech/tags/integrations.md>), [migration](<https://devfeed.tech/tags/migration.md>), [new-features](<https://devfeed.tech/tags/new-features.md>), [product](<https://devfeed.tech/tags/product.md>), [product-features](<https://devfeed.tech/tags/product-features.md>), [releases](<https://devfeed.tech/tags/releases.md>), [what-s-new-chainguard-webinar](<https://devfeed.tech/tags/what-s-new-chainguard-webinar.md>)

### AI overview

Chainguard's December 2025 update reviews new product capabilities for Chainguard Containers and Chainguard Libraries. It highlights more than 40 first-party Helm Charts designed to support migrations from Bitnami while maintaining drop-in compatibility, alongside efforts to reduce security toil and workflow disruption.

### Source excerpt

Explore all the latest features and releases for Chainguard Containers and Chainguard Libraries.

## Anchore Enterprise now validates Chainguard Libraries: prevent 98% of Python malware and eliminate high-severity CVE toil

DevFeed: [Anchore Enterprise now validates Chainguard Libraries: prevent 98% of Python malware and eliminate high-severity CVE toil](<https://devfeed.tech/articles/anchore-enterprise-now-validates-chainguard-libraries-prevent-98-of-python-malware-and-eliminate-high-severity-cve-toil-12872.md>)

Original publisher: [Read original article](<https://www.chainguard.dev/unchained/anchore-enterprise-now-validates-chainguard-libraries>)

Published: 2025-12-04T00:00:00Z

Content type: article

Language: en

Sources: [Chainguard: Unchained](<https://devfeed.tech/sources/chainguard-unchained.md>)

Topics: [chainguard libraries](<https://devfeed.tech/topics/chainguard-libraries.md>), [Python](<https://devfeed.tech/topics/python.md>), [supply-chain-security](<https://devfeed.tech/topics/supply-chain-security.md>), [Malware](<https://devfeed.tech/topics/malware.md>), [Open Source](<https://devfeed.tech/topics/open-source.md>)

Tags: [anchore](<https://devfeed.tech/tags/anchore.md>), [anchore-chainguard](<https://devfeed.tech/tags/anchore-chainguard.md>), [anchore-chainguard-partnership](<https://devfeed.tech/tags/anchore-chainguard-partnership.md>), [anchore-enterprise](<https://devfeed.tech/tags/anchore-enterprise.md>), [chainguard](<https://devfeed.tech/tags/chainguard.md>), [chainguard-libraries](<https://devfeed.tech/tags/chainguard-libraries.md>), [chainguard-libraries-for-python](<https://devfeed.tech/tags/chainguard-libraries-for-python.md>), [dependencies](<https://devfeed.tech/tags/dependencies.md>), [malware](<https://devfeed.tech/tags/malware.md>), [provenance](<https://devfeed.tech/tags/provenance.md>), [python](<https://devfeed.tech/tags/python.md>), [sboms](<https://devfeed.tech/tags/sboms.md>), [slsa](<https://devfeed.tech/tags/slsa.md>), [supply-chain](<https://devfeed.tech/tags/supply-chain.md>), [supply-chain-security](<https://devfeed.tech/tags/supply-chain-security.md>)

### AI overview

Anchore Enterprise now supports scanning and validating Chainguard Libraries for Python. The integration combines Anchore's supply-chain security enforcement with Python libraries built from source in a tamper-proof, SLSA L2-certified environment with provenance and signed SBOMs, aiming to prevent malware introduced during build or distribution and reduce high-severity CVE remediation effort.

### Source excerpt

Customers can now leverage Anchore Enterprise's scanning capabilities for Chainguard Libraries for Python.

## Announcing AWS Inspector scanner support for Chainguard Libraries

DevFeed: [Announcing AWS Inspector scanner support for Chainguard Libraries](<https://devfeed.tech/articles/announcing-aws-inspector-scanner-support-for-chainguard-libraries-12874.md>)

Original publisher: [Read original article](<https://www.chainguard.dev/unchained/announcing-aws-inspector-scanner-support-for-chainguard-libraries>)

Published: 2025-11-24T00:00:00Z

Content type: news

Language: en

Sources: [Chainguard: Unchained](<https://devfeed.tech/sources/chainguard-unchained.md>)

Topics: [chainguard libraries](<https://devfeed.tech/topics/chainguard-libraries.md>), [Amazon Web Services](<https://devfeed.tech/topics/aws.md>), [vulnerability management](<https://devfeed.tech/topics/vulnerability-management.md>), [Malware](<https://devfeed.tech/topics/malware.md>), [vulnerability](<https://devfeed.tech/topics/vulnerability.md>), [container images](<https://devfeed.tech/topics/container-images.md>), [Python](<https://devfeed.tech/topics/python.md>), [Django](<https://devfeed.tech/topics/django.md>), [Flask](<https://devfeed.tech/topics/flask.md>)

Tags: [amazon-scanner-support](<https://devfeed.tech/tags/amazon-scanner-support.md>), [aws](<https://devfeed.tech/tags/aws.md>), [aws-inspector](<https://devfeed.tech/tags/aws-inspector.md>), [chainguard-aws-integration](<https://devfeed.tech/tags/chainguard-aws-integration.md>), [chainguard-libraries](<https://devfeed.tech/tags/chainguard-libraries.md>), [chainguard-libraries-for-python](<https://devfeed.tech/tags/chainguard-libraries-for-python.md>), [chainguard-libraries-for-python-aws](<https://devfeed.tech/tags/chainguard-libraries-for-python-aws.md>), [chainguard-packages](<https://devfeed.tech/tags/chainguard-packages.md>), [container-images](<https://devfeed.tech/tags/container-images.md>), [cve](<https://devfeed.tech/tags/cve.md>), [cve-remediation](<https://devfeed.tech/tags/cve-remediation.md>), [django](<https://devfeed.tech/tags/django.md>), [flask](<https://devfeed.tech/tags/flask.md>), [malware](<https://devfeed.tech/tags/malware.md>), [malware-prevention](<https://devfeed.tech/tags/malware-prevention.md>), [python](<https://devfeed.tech/tags/python.md>), [security](<https://devfeed.tech/tags/security.md>), [vulnerabilities](<https://devfeed.tech/tags/vulnerabilities.md>), [vulnerability](<https://devfeed.tech/tags/vulnerability.md>), [vulnerability-management](<https://devfeed.tech/tags/vulnerability-management.md>)

### AI overview

Chainguard Libraries for Python now integrates with Amazon Inspector's enhanced scanning for Amazon ECR. The integration provides malware prevention, recognition of Chainguard-remediated CVEs, and a unified view of container and library vulnerabilities across AWS workloads.

### Source excerpt

Chainguard Libraries now integrates with AWS Inspector, bringing proactive malware prevention, CVE remediation, and vulnerability visibility across AWS workloads

## Chainguard Libraries for Python: Now Generally Available with CVE Remediation and Malware Protection

DevFeed: [Chainguard Libraries for Python: Now Generally Available with CVE Remediation and Malware Protection](<https://devfeed.tech/articles/chainguard-libraries-for-python-now-generally-available-with-cve-remediation-and-malware-protection-12967.md>)

Original publisher: [Read original article](<https://www.chainguard.dev/unchained/chainguard-libraries-for-python-now-generally-available-with-cve-remediation-and-malware-protection>)

Published: 2025-10-22T00:00:00Z

Content type: release

Language: en

Sources: [Chainguard: Unchained](<https://devfeed.tech/sources/chainguard-unchained.md>)

Topics: [chainguard libraries for python](<https://devfeed.tech/topics/chainguard-libraries-for-python.md>), [chainguard libraries](<https://devfeed.tech/topics/chainguard-libraries.md>), [Python](<https://devfeed.tech/topics/python.md>), [Malware](<https://devfeed.tech/topics/malware.md>), [Open Source](<https://devfeed.tech/topics/open-source.md>), [supply-chain-security](<https://devfeed.tech/topics/supply-chain-security.md>), [Vulnerabilities](<https://devfeed.tech/topics/vulnerabilities.md>)

Tags: [chainguard](<https://devfeed.tech/tags/chainguard.md>), [chainguard-language-libraries](<https://devfeed.tech/tags/chainguard-language-libraries.md>), [chainguard-libraries](<https://devfeed.tech/tags/chainguard-libraries.md>), [chainguard-libraries-for-python](<https://devfeed.tech/tags/chainguard-libraries-for-python.md>), [cve](<https://devfeed.tech/tags/cve.md>), [cve-remediation](<https://devfeed.tech/tags/cve-remediation.md>), [language-libraries-malware](<https://devfeed.tech/tags/language-libraries-malware.md>), [malware-prevention](<https://devfeed.tech/tags/malware-prevention.md>), [malware-protection](<https://devfeed.tech/tags/malware-protection.md>), [open-source](<https://devfeed.tech/tags/open-source.md>), [python](<https://devfeed.tech/tags/python.md>), [python-libraries](<https://devfeed.tech/tags/python-libraries.md>), [secure-python-libraries](<https://devfeed.tech/tags/secure-python-libraries.md>), [software-supply-chain](<https://devfeed.tech/tags/software-supply-chain.md>), [supply-chain-attacks](<https://devfeed.tech/tags/supply-chain-attacks.md>), [vulnerabilities](<https://devfeed.tech/tags/vulnerabilities.md>)

### AI overview

Chainguard Libraries for Python is generally available as a trusted-build distribution of open source Python libraries. It builds packages from source, distributes them through hardened infrastructure, continuously monitors them, and provides malware protection and CVE remediation through backported patches for selected critical and high-severity vulnerabilities.

### Source excerpt

Chainguard Libraries for Python, trusted open source language libraries designed for CVE remediation and malware protection, is now generally available.

## Mitigating malware in the npm ecosystem with Chainguard Libraries

DevFeed: [Mitigating malware in the npm ecosystem with Chainguard Libraries](<https://devfeed.tech/articles/mitigating-malware-in-the-npm-ecosystem-with-chainguard-libraries-13162.md>)

Original publisher: [Read original article](<https://www.chainguard.dev/unchained/mitigating-malware-in-the-npm-ecosystem-with-chainguard-libraries>)

Published: 2025-10-02T00:00:00Z

Content type: article

Language: en

Sources: [Chainguard: Unchained](<https://devfeed.tech/sources/chainguard-unchained.md>)

Topics: [chainguard libraries](<https://devfeed.tech/topics/chainguard-libraries.md>), [Malware](<https://devfeed.tech/topics/malware.md>), [npm packages](<https://devfeed.tech/topics/npm-packages.md>), [npm](<https://devfeed.tech/topics/npm.md>), [Security](<https://devfeed.tech/topics/security.md>), [GitHub](<https://devfeed.tech/topics/github.md>), [Open Source](<https://devfeed.tech/topics/open-source.md>)

Tags: [chainguard](<https://devfeed.tech/tags/chainguard.md>), [chainguard-ecosystem](<https://devfeed.tech/tags/chainguard-ecosystem.md>), [chainguard-libraries](<https://devfeed.tech/tags/chainguard-libraries.md>), [chainguard-libraries-for-javascript](<https://devfeed.tech/tags/chainguard-libraries-for-javascript.md>), [javascript](<https://devfeed.tech/tags/javascript.md>), [malicious-packages](<https://devfeed.tech/tags/malicious-packages.md>), [malware](<https://devfeed.tech/tags/malware.md>), [npm](<https://devfeed.tech/tags/npm.md>), [npm-malware](<https://devfeed.tech/tags/npm-malware.md>), [npm-package-attack](<https://devfeed.tech/tags/npm-package-attack.md>), [npm-packages](<https://devfeed.tech/tags/npm-packages.md>), [open-source](<https://devfeed.tech/tags/open-source.md>), [security](<https://devfeed.tech/tags/security.md>), [software-supply-chain](<https://devfeed.tech/tags/software-supply-chain.md>)

### AI overview

The article presents research on using Chainguard Libraries for JavaScript to mitigate malware in the npm ecosystem. By requiring attributable source code and validating source-to-artifact integrity through a build-from-source pipeline, the study found that approximately 99% of 8,783 known malicious npm packages would have been prevented from publication, while approximately 99.7% were blocked for users relying on Chainguard Libraries as their sole source of npm dependencies.

### Source excerpt

In a recent analysis, Chainguard Libraries for JavaScript prevented over 99% of malicious npm packages published to the npm registry.

## Announcing Chainguard Libraries for JavaScript: Malware-Resistant Dependencies Built Securely from Source

DevFeed: [Announcing Chainguard Libraries for JavaScript: Malware-Resistant Dependencies Built Securely from Source](<https://devfeed.tech/articles/announcing-chainguard-libraries-for-javascript-malware-resistant-dependencies-built-securely-from-source-12879.md>)

Original publisher: [Read original article](<https://www.chainguard.dev/unchained/announcing-chainguard-libraries-for-javascript-malware-resistant-dependencies-built-securely-from-source>)

Published: 2025-09-25T00:00:00Z

Content type: article

Language: en

Sources: [Chainguard: Unchained](<https://devfeed.tech/sources/chainguard-unchained.md>)

Topics: [chainguard libraries](<https://devfeed.tech/topics/chainguard-libraries.md>), [JavaScript](<https://devfeed.tech/topics/javascript.md>), [Malware](<https://devfeed.tech/topics/malware.md>), [npm packages](<https://devfeed.tech/topics/npm-packages.md>), [npm](<https://devfeed.tech/topics/npm.md>)

Tags: [attacks](<https://devfeed.tech/tags/attacks.md>), [chainguard](<https://devfeed.tech/tags/chainguard.md>), [chainguard-libraries](<https://devfeed.tech/tags/chainguard-libraries.md>), [chainguard-libraries-for-javascript](<https://devfeed.tech/tags/chainguard-libraries-for-javascript.md>), [javacript](<https://devfeed.tech/tags/javacript.md>), [javascript](<https://devfeed.tech/tags/javascript.md>), [language-library-security](<https://devfeed.tech/tags/language-library-security.md>), [malware](<https://devfeed.tech/tags/malware.md>), [npm](<https://devfeed.tech/tags/npm.md>), [npm-packages](<https://devfeed.tech/tags/npm-packages.md>), [package-compromise](<https://devfeed.tech/tags/package-compromise.md>), [provenance](<https://devfeed.tech/tags/provenance.md>), [shai-hulud](<https://devfeed.tech/tags/shai-hulud.md>), [slsa](<https://devfeed.tech/tags/slsa.md>)

### AI overview

Chainguard announces Chainguard Libraries for JavaScript, a source of trusted language-dependency builds intended to protect developers and organizations from compromised packages, malicious updates, and registry-based attacks. The libraries are built from source on hardened SLSA L2 infrastructure, include provenance, and are designed to fit existing developer workflows.

### Source excerpt

Chainguard Libraries for JavaScript is designed to protect developers and organizations from compromised packages, malicious updates, and registry-based attacks.

## Registries and the npm Breach: Securing the Weakest Link in the Software Supply Chain

DevFeed: [Registries and the npm Breach: Securing the Weakest Link in the Software Supply Chain](<https://devfeed.tech/articles/registries-and-the-npm-breach-securing-the-weakest-link-in-the-software-supply-chain-13208.md>)

Original publisher: [Read original article](<https://www.chainguard.dev/unchained/registries-and-the-npm-breach-securing-the-weakest-link-in-the-software-supply-chain>)

Published: 2025-09-10T00:00:00Z

Content type: article

Language: en

Sources: [Chainguard: Unchained](<https://devfeed.tech/sources/chainguard-unchained.md>)

Topics: [supply-chain-security](<https://devfeed.tech/topics/supply-chain-security.md>), [npm](<https://devfeed.tech/topics/npm.md>), [chainguard libraries](<https://devfeed.tech/topics/chainguard-libraries.md>), [Malware](<https://devfeed.tech/topics/malware.md>), [Software](<https://devfeed.tech/topics/software.md>)

Tags: [account-takeover](<https://devfeed.tech/tags/account-takeover.md>), [api-keys](<https://devfeed.tech/tags/api-keys.md>), [chainguard-libraries](<https://devfeed.tech/tags/chainguard-libraries.md>), [chainguard-libraries-for-java](<https://devfeed.tech/tags/chainguard-libraries-for-java.md>), [chainguard-libraries-for-python](<https://devfeed.tech/tags/chainguard-libraries-for-python.md>), [ci-cd](<https://devfeed.tech/tags/ci-cd.md>), [malware](<https://devfeed.tech/tags/malware.md>), [malware-prevention](<https://devfeed.tech/tags/malware-prevention.md>), [npm](<https://devfeed.tech/tags/npm.md>), [npm-compromise](<https://devfeed.tech/tags/npm-compromise.md>), [security](<https://devfeed.tech/tags/security.md>), [software-supply-chain](<https://devfeed.tech/tags/software-supply-chain.md>), [supply-chain](<https://devfeed.tech/tags/supply-chain.md>), [supply-chain-attacks](<https://devfeed.tech/tags/supply-chain-attacks.md>)

### AI overview

The article examines a compromise affecting 20 popular npm packages and explains how package-registry attacks can steal environment variables and API keys, establish production backdoors, compromise CI/CD processes, and evade existing supply-chain controls. It presents Chainguard Libraries as a defense based on going back to source repositories.

### Source excerpt

Chainguard Libraries provides a different and proven defense against supply chain attacks like the recent npm breach. See why preventing malware is important.

[Next page](<https://devfeed.tech/topics/chainguard-libraries.md?cursor=WyIyMDI1LTA5LTEwVDAwOjAwOjAwKzAwOjAwIiwgIjU0MDMzMjUyLWMwZmItNDg5NS04NTJjLTdmNjcyZTBjMTI3ZCJd>)