Chainguard has expanded Chainguard Libraries with new offerings for Go and .NET, enabling engineering teams and AI agents to access language-specific dependencies while reducing exposure to software supply chain attacks. The platform now also provides CVE remediation for JavaScript and Go, backporting fixes for critical- and high-severity vulnerabilities when immediate upgrades are not feasible. Additionally, Chainguard Libraries offers protection against zero-day vulnerabilities, delivering fixes as soon as vulnerabilities become public. Powered by Athena’s crowdsourced threat intelligence, customers gain access to innovative patches for zero-day vulnerabilities uncovered by leading institutions using frontier AI models to test their applications.
Malware poses an increasing threat to open source dependencies
AI has escalated problems that have plagued open source language libraries for years, and malware is at the front of that shift. According to Chainguard’s AI Exploit Gap report, 76% of cybersecurity leaders say their organization has experienced, or suspects it has experienced, an AI-driven attack in the last 12 months. Within open source registries, attackers are publishing malicious packages, hijacking trusted packages, and registering the names of packages that do not exist yet, knowing developers and AI agents will install them without a second look. At the same time, AI makes it possible for anyone to build and publish malicious packages, or find a way to gain improper access to internal systems by exploiting CVEs or newly discovered zero-day vulnerabilities. The risks are not new, but they are increasingly impossible to manage at scale as models become more capable and widely available.
Protecting organizations from AI-level threats to open source software
Preventing malware from dependencies is only one part of a three-part problem. Organizations still need to worry about CVEs and zero-days that are becoming easier to discover and exploit as the capabilities of frontier AI models improve. Teams often pin dependencies to specific versions for stability, and CVEs build up in those versions over time. Meanwhile, frontier AI models are uncovering zero-days faster than open source maintainers can fix them. With today’s announcement, Chainguard Libraries protects against all three threats across more of the languages organizations depend on:
● Introducing Chainguard Libraries for Go with CVE remediation: Chainguard Libraries for Go gives cloud and infrastructure development teams a secure endpoint to pull Go packages, limiting their organization’s exposure to malicious modules and reducing the number of CVEs they need to remediate. Go Libraries come with built-in scanning for malware and greyware, a class of nefarious open source packages that traditional malware scanners miss. They also include configurable policies that allow teams to block packages that don’t meet their security or compliance standards, and CVE remediation.
● Introducing Chainguard Libraries for .NET: Chainguard Libraries for .NET allows organizations building on top of the Microsoft and Azure ecosystems to trade NuGet for a secure-by-default Chainguard-managed endpoint, allowing them to safely pull dependencies without risking being compromised by the next supply chain attack. .NET libraries come with configurable policies and malware and greyware scanning.
● Enhancing JavaScript libraries with CVE remediation: Adding CVE remediation to Chainguard Libraries for JavaScript provides another layer of defense that reduces CVE risk. Backported fixes for critical- and high-severity CVEs allow engineering teams to shrink known vulnerability risk while strategically planning their next major version upgrade. The capability is built into the same endpoint that has blocked every malware attack that has hit npm this year.
● Providing zero-day protection for Chainguard Libraries for Java and Python: Chainguard Libraries for Python and Java now have artifacts that are remediated from frontier AI model-discovered vulnerabilities on the day they are publicly disclosed. This protection is powered by the crowdsourced threat intelligence of Athena, Chainguard’s industry coalition for the orchestrated defense of open source software.
These advancements make Chainguard Libraries the most secure way to consume open source language dependencies. Chainguard Libraries helps organizations defend against the threats frontier AI models pose to open source software and to the AI software development lifecycle.
Chainguard Libraries for Go and .NET are now available in Early Access at the website here.
Related News:
Chainguard Reaches 94% Coverage Across Python, Java, and JavaScript
Chainguard Container Images Surpass 500 Million Container Build Manifests
