Chainguard Libraries now includes CVE remediation for JavaScript and Go; customers also receive protections from frontier AI-discovered zero-days once they are made public

SEATTLE, Oct. 14, 2026 /PRNewswire/ -- Chainguard, the trusted source for open source, today announced Chainguard Libraries for Go and Chainguard Libraries for .NET, adding coverage for two new language ecosystems that allow engineering teams and AI agents to safely pull Go and .NET dependencies without being exposed to the next supply chain attack. Chainguard Libraries also now offers CVE remediation for JavaScript and Go, which backports upstream fixes for critical- and high-severity vulnerabilities, helping teams where upgrading to the next version is not always immediately possible. Finally, Chainguard Libraries now protects customers from zero-day vulnerabilities, with fixes available the day a vulnerability is made public. Through Athena's crowdsourced threat intelligence, Chainguard Libraries customers receive novel patches for zero-day vulnerabilities that have been discovered by the world's largest institutions pointing frontier AI models at their applications.

Malware poses an increasing threat to open source dependencies

AI has escalated problems that have plagued open source language libraries for years, and malware is at the front of that shift. According to Chainguard's AI Exploit Gap report, 76% of cybersecurity leaders say their organization has experienced, or suspects it has experienced, an AI-driven attack in the last 12 months. Within open source registries, attackers are publishing malicious packages, hijacking trusted packages, and registering the names of packages that do not exist yet, knowing developers and AI agents will install them without a second look. At the same time, AI makes it possible for anyone to build and publish malicious packages, or find a way to gain improper access to internal systems by exploiting CVEs or newly discovered zero-day vulnerabilities. The risks are not new, but they are increasingly impossible to manage at scale as models become more capable and widely available.

"Attackers are counting on your developers and AI agents to trust every package they install," said Patrick Donahue, SVP of Product, Chainguard. "Chainguard Libraries removes the need for that trust. No malware gets in, CVEs get fixed even if you can't upgrade, and zero-days are patched on disclosure day. Prevention is the only defense that scales."

Protecting organizations from AI-level threats to open source software

Preventing malware from dependencies is only one part of a three-part problem. Organizations still need to worry about CVEs and zero-days that are becoming easier to discover and exploit as the capabilities of frontier AI models improve. Teams often pin dependencies to specific versions for stability, and CVEs build up in those versions over time. Meanwhile, frontier AI models are uncovering zero-days faster than open source maintainers can fix them. With today's announcement, Chainguard Libraries protects against all three threats across more of the languages organizations depend on:

• Introducing Chainguard Libraries for Go with CVE remediation: Chainguard Libraries for Go gives cloud and infrastructure development teams a secure endpoint to pull Go packages, limiting their organization's exposure to malicious modules and reducing the number of CVEs they need to remediate. Go Libraries come with built-in scanning for malware and greyware, a class of nefarious open source packages that traditional malware scanners miss. They also include configurable policies that allow teams to block packages that don't meet their security or compliance standards, and CVE remediation.
• Introducing Chainguard Libraries for .NET: Chainguard Libraries for .NET allows organizations building on top of the Microsoft and Azure ecosystems to trade NuGet for a secure-by-default Chainguard-managed endpoint, allowing them to safely pull dependencies without risking being compromised by the next supply chain attack. .NET libraries come with configurable policies and malware and greyware scanning.
• Enhancing JavaScript libraries with CVE remediation: Adding CVE remediation to Chainguard Libraries for JavaScript provides another layer of defense that reduces CVE risk. Backported fixes for critical- and high-severity CVEs allow engineering teams to shrink known vulnerability risk while strategically planning their next major version upgrade. The capability is built into the same endpoint that has blocked every malware attack that has hit npm this year.
• Providing zero-day protection for Chainguard Libraries for Java and Python: Chainguard Libraries for Python and Java now have artifacts that are remediated from frontier AI model-discovered vulnerabilities on the day they are publicly disclosed. This protection is powered by the crowdsourced threat intelligence of Athena, Chainguard's industry coalition for the orchestrated defense of open source software.

These advancements make Chainguard Libraries the most secure way to consume open source language dependencies. Chainguard Libraries helps organizations defend against the threats frontier AI models pose to open source software and to the AI software development lifecycle.

"Chainguard Libraries has shifted us from reacting to supply chain attacks to preventing them. We have immediate visibility into what's coming into our environment, but more importantly, malicious packages never reach us in the first place," said Kevin Fuller, CISO, Propio. "It's not just detection, it's prevention. With constant attacks on open source, that has given our team a world of peace."

Chainguard Libraries for Go and .NET are now available in Early Access. For more information, visit chainguard.dev/libraries.

About Chainguard
Chainguard is the trusted source for open source. By providing engineers and AI agents with hardened, trusted, and production-ready artifacts, Chainguard helps organizations prevent AI supply chain attacks, increase engineering velocity while reducing toil, and maintain continuous compliance. Customers include Fortune 500 enterprises and global industry leaders, including Anduril, Canva, DocuSign, OpenAI, Public Storage, Snap Inc., and Snowflake. Chainguard is venture-backed by leading investors, including Amplify, IVP, Kleiner Perkins, Lightspeed Venture Partners, Mantis VC, Redpoint Ventures, Sequoia Capital, and Spark Capital.  For more information, visit: https://www.chainguard.dev/

Media Contact: Brittany Hendrickson, press@chainguard.dev

View original content to download multimedia:https://www.prnewswire.com/news-releases/introducing-chainguard-libraries-for-go-and-net-secure-endpoints-to-protect-organizations-from-supply-chain-attacks-302907708.html

SOURCE Chainguard