Chainguard Libraries | Secure Open Source Dependencies

Prevent AI attacks on your language dependencies

Switch standard registry endpoints to Chainguard to prevent malware, shrink your CVE backlog, and remediate frontier AI-discovered zero-days so your engineers and agents always pull safe, trusted packages.

The world’s leading companies trust Chainguard

Security or dev velocity. Why choose?

Supply chain attacks are weekly occurrences. Daily CVE reports are up 80%+ this year. Chainguard Libraries let’s your team avoid the security noise and focus on the product roadmap.

Prevent malware by design

Stop malicious packages before they ever reach your environment with a catalog of open source dependencies that are built and vetted by Chainguard.

Eliminate vulnerabilities

Limit CVE and zero-day exposure for versions you're stuck on with Chainguard-remediated artifacts, allowing you to stay safe while you plan your next upgrade.

Avoid security toil

End the patching, incident response, and security tax that comes with monitoring your dependencies so your developers and agents stay focused on the roadmap.

Chainguard replaces your public registry endpoints

Stop reacting to supply chain attacks and start preventing them. Chainguard Libraries is a malware-free catalog of open source dependencies that allows your team to ship without inheriting someone else’s security compromise.

SUPPORTED ECOSYSTEMS

Malwhere? Not here.

Whether it’s a malicious backdoored binary, install-time script, or typosquatted package, Chainguard Libraries are safe from the malware compromises that have made headlines over the last few months.

axios

Nation-state actors attacked the HTTP requests package in npm that’s used 400M+ times a month.

litellm

Attackers hit a key AI gateway package in PyPI with 280M+ monthly downloads.

Shai-Hulud

A worm spread through ~800 npm packages and harvested thousands of private credentials.

tanstack

A typosquatted npm dependency duped @TanStack users with four malicious versions.

elementary-data

Attackers released malicious version of an AI project with 1.1M+ monthly downloads.

chalk

Bad actors released 18 npm packages with more than 10B+ collective monthly downloads.

Step off the remediation treadmill with Chainguard-patched artifacts

CVE backports for versions you’re stuck on

Fix CVEs in legacy dependencies without forcing version bumps. Every remediated package includes embedded SLSA L3 provenance and SBOMs, letting auditors verify patches with a single CLI command.

Zero-day protection on day zero, powered by Athena

Benefit from the crowdsourced threat intelligence of the world’s largest institutions. Get day zero access to thousands of packages pre-patched against AI-discovered vulnerabilities, keeping your data safe from hackers.

Works with your existing tooling

Chainguard Libraries works with your existing artifact managers and workflows. Each package has the same functionality as the public upstream version, so there are no breaking changes. Your engineers won’t notice a difference.

Embedded policies protect what’s not built

With the Chainguard Repository, you get every package you need on day one. Configure cooldowns and block packages that don't meet your organization's standards. Your supply chain security improves overnight.

Every package is scanned for malicious behavior

Our software factory scans for malware and 'greyware' packages before any artifact can reach your team. With Chainguard, you don’t have an exposure window because we never build or distribute packages until they’re marked safe.

Signed, sealed, and dependable

Every Chainguard-built version comes built with full provenance and signed SBOMs, giving you indisputable proof that your dependencies came from the SLSA L3-compliant Chainguard Factory and not a vulnerable maintainer account.

Trust in every phase of the SDLC

Frequently Asked Questions

What is a malware-resistant library?

A malware-free dependency catalog is a curated repository of open source packages that's built from verified source code and protected by layered security controls. The curated repository replaces direct developer access to public registries like npm, PyPI, and Maven Central.

How much does Chainguard reduce the risk of supply chain attacks?

Chainguard significantly reduces supply chain attack risk by rebuilding every library from verified source code in tamper-proof environment, preventing malicious code injection at the build and distribution stages.

How do language package supply chain attacks happen?

Attackers often compromise the build systems where packages are compiled or hijack distribution by stealing developer credentials to upload malicious versions to registries like npm, PyPI, or Maven Central.

What does "built from source" mean?

"Built from source" means Chainguard rebuilds every library from its original source code repository rather than downloading pre-compiled artifacts from public registries. This creates a trusted, verifiable chain of custody.

Which package ecosystems and languages does Chainguard Libraries support?

Chainguard Libraries currently supports JavaScript (npm), Java (Maven), and Python (PyPI). Additional language ecosystems are being considered based on customer demand.

Can I use Chainguard Libraries with my existing artifact manager?

Yes. Chainguard Libraries integrates with common artifact managers such as JFrog Artifactory, Sonatype Nexus Repository, and Cloudsmith.

What verification and attestations come with Chainguard Libraries?

Every Chainguard-built package ships with Sigstore signatures, a signed SBOM, and SLSA Level 3 provenance.