Tag: SLSA framework

Chainguard Expands Repository to Add More Secure Open Source Libraries

Chainguard has expanded the number of secure open source libraries it makes available to include Java and JavaScript components based on code it has reworked to better secure software supply chains. Additionally, an expanded set of secure Python libraries, first introduced last year, is now generally available.

Bria Giordano, libraries lead for Chainguard, said the overall goal is to better secure software supply chains by making available a repository that organizations pay to access, from which developers can download software artifacts and components that adhere to Level 2 of the Supply-chain Levels for Software Artifacts (SLSA) framework defined by the Open Source Security Foundation (OpenSSF).

In total, Chainguard has rebuilt nearly one million unique versions of Java dependencies, including enterprise essentials such as Spring Boot, Jackson, Apache Commons, and Log4j, using the Chainguard Factory, an automated platform for creating software builds based on code originally found in open source software repositories.

Chainguard also covers 88% of the top 500 highest-impact JavaScript libraries, along with tens of thousands of additional libraries. Finally, Chainguard now covers 94% of Python dependencies typically found in applications.

In the last year, security researchers discovered more than 450,000 malicious packages. Chainguard provides DevOps teams with an alternative repository for downloading secure libraries and containers, constructed by developers that are augmented by artificial intelligence (AI) agents, to create libraries in a way that adheres to best DevSecOps practices.

That approach eliminates the need to rely on individual application developers to test every component they use for known vulnerabilities, noted Giordano. It’s simply not realistic to expect developers to keep track of millions of open source libraries that are found in repositories all across the web, she added. Instead, Chainguard researchers continuously monitor open source software projects for updates to ensure the libraries made available are based on the latest version of the code made available by maintainers, noted Giordano.

It’s not clear to what degree DevOps teams are adopting repositories that provide access to inherently more secure software than what might be found on GitHub or Maven. A recent Futurum Group survey finds that about 35% said they also plan to make some type of investment in application security, with well over a third of respondents expecting their organization to increase spending on software security testing (39%) and application programming interface (API) security (36%) over the next 12 to 18 months.

Chainguard, however, is making a case for resolving application security issues at the root cause by ensuring that the code that is often reused to build applications is fundamentally secure.

Mitch Ashley, vice president and practice lead for software lifecycle engineering at The Futurum Group, said Chainguard’s expansion of its repository service shifts supply chain security from perimeter defense to source control. Rebuilding at the dependency layer targets the unverified libraries where most of the issues that led to an application security incident really began, he said.

Hopefully, there will come a time when AI tools generate open source code that has fewer vulnerabilities than what is being seen today, but in the meantime, DevOps teams would be well-advised to always consider the source when downloading any type of software component.

March 4, 2026
Chainguard Adds Curated Repository to Secure JavaScript Libraries

Chainguard today made available via a private beta program a set of curated JavaScript libraries to its portfolio of curated libraries that it provides to secure software supply chains.

Patrick Donahue, senior vice president for product at Chainguard, said that in the wake of a series of incidents involving node package manager (NPM) repositories, including now the infamous Shai-Hulud cyberattack, the need for an alternative Chainguard Libraries for JavaScript repository that reduces the chances of malware being introduced into a JavaScript software supply chain has become especially acute.

The Chainguard Libraries for JavaScript service from Chainguard provides access to a collection of curated builds of thousands of common JavaScript dependencies that were created from source using a platform based on the Supply-chain Levels for Software Artifacts (SLSA) framework originally developed by Google.

Chainguard then makes those libraries available in whatever way they already consume libraries, either through direct download from Chainguard or with existing artifact managers, such as JFrog Artifactory and Sonatype Nexus.

As valuable a service that npm repositories have provided, the simple fact of the matter is that the maintainers of these platforms simply lack the resources and expertise required to curate JavaScript libraries, noted Donahue. As such, the need for an alternative approach that provides enterprise IT organizations with access to a set of curated libraries that are free of known malware is now critical, said Donahue. Additionally, if any new type of malware is discovered, Chainguard will refresh the libraries it provides to eliminate it.

DevSecOps teams have been struggling with securing open source software for years now, but more recently, cybercriminals have become more adept at injecting malware into software supply chains that they hope to activate at some later date. They may not know which downstream application malware might one day manifest itself in, but they are betting that a significant percentage of them will present them with high-value targets after they have been deployed in a production environment.

Hopefully, cybersecurity teams are using scanning tools to discover any malware before an application is deployed, but in many instances, that malware may be difficult to discover because it is hidden in an open source software component that was downloaded from a public repository. More troubling still, much of that malware is being designed in ways that enable it to evade detection by the scanners used by cybersecurity teams.

It’s not clear to what degree cybersecurity threats aimed at software supply chains have become a crisis, but as regulations holding organizations more accountable for flaws in the software they ship become more stringent, more organizations than ever are adopting best DevSecOps practices to improve application security. Unfortunately, adoption of best DevSecOps practices has been historically uneven so the chance there will be more application security incidents in the months ahead is fairly high at a time when, thanks to the rise of artificial intelligence (AI), the pace at which insecure applications are being built and deployed is only going to accelerate.

September 25, 2025

Tag: SLSA framework

Chainguard Expands Repository to Add More Secure Open Source Libraries

Chainguard Adds Curated Repository to Secure JavaScript Libraries