Chainguard Libraries Adds Go and .NET, Plus Zero-Day Patches on Disclosure Day

Two new language ecosystems

Chainguard, which describes itself as the trusted source for open source, said the new offerings let engineering teams and AI agents pull Go and .NET dependencies without being exposed to the next supply chain attack.

Go: Chainguard Libraries for Go is aimed at cloud and infrastructure development teams. It provides a secure endpoint for pulling Go packages, which according to the company limits exposure to malicious modules and reduces the number of CVEs teams must remediate. It includes built-in scanning for malware and greyware, which Chainguard defines as a class of nefarious open source packages that traditional malware scanners miss. Teams can also configure policies to block packages that fail their security or compliance standards.

.NET: Chainguard Libraries for .NET targets organizations building on the Microsoft and Azure ecosystems. They can swap NuGet for a Chainguard-managed endpoint that is secure by default. The .NET libraries include configurable policies and malware and greyware scanning.

CVE remediation and zero-day protection

Chainguard Libraries now offers CVE remediation for JavaScript and Go. The feature backports upstream fixes for critical- and high-severity vulnerabilities, which helps teams that cannot always upgrade to the next version right away. Chainguard notes that teams often pin dependencies to specific versions for stability, and that CVEs build up in those versions over time. According to the company, the JavaScript capability is built into the same endpoint that has blocked every malware attack that has hit npm this year.

For zero-days, Chainguard Libraries for Python and Java now include artifacts remediated against vulnerabilities discovered by frontier AI models, available on the day they are publicly disclosed. The protection draws on the crowdsourced threat intelligence of Athena, Chainguard's industry coalition for the orchestrated defense of open source software. The company says customers receive novel patches for zero-days found by the world's largest institutions pointing frontier AI models at their applications.

The threat picture according to Chainguard

Chainguard argues that AI has escalated long-standing problems in open source language libraries, with malware at the front. It cites its own AI Exploit Gap report, in which 76% of cybersecurity leaders say their organization has experienced, or suspects it has experienced, an AI-driven attack in the last 12 months.

The company says attackers publish malicious packages, hijack trusted ones, and register names of packages that do not exist yet, expecting developers and AI agents to install them without a second look. It also says AI lets more people build and publish malicious packages or exploit CVEs and newly found zero-days. In its view, frontier AI models are uncovering zero-days faster than open source maintainers can fix them.

"Attackers are counting on your developers and AI agents to trust every package they install," said Patrick Donahue, SVP of Product at Chainguard. "Prevention is the only defense that scales."

Availability and what it means for customers

Chainguard Libraries for Go and .NET are available in Early Access. The company directs interested organizations to chainguard.dev/libraries. The source does not give pricing or a general availability date.

For teams, the update widens the set of languages covered by a single vendor approach to dependency security, now spanning malware blocking, CVE backporting and zero-day fixes in varying combinations across Go, .NET, JavaScript, Java and Python. Kevin Fuller, CISO at Chainguard customer Propio, said the product "has shifted us from reacting to supply chain attacks to preventing them." These are claims from Chainguard and one of its customers, and the release does not include independent testing.