Seattle – October 14, 2026 -- Chainguard has extended its Libraries product to Go and .NET, added CVE remediation for JavaScript and Go, and begun delivering fixes for zero-day vulnerabilities on the day they are made public.
Chainguard Libraries for Go and .NET are available in Early Access. They give engineering teams and AI agents a managed endpoint for pulling dependencies without exposure to malicious packages.
Chainguard cites 76% AI-attack exposure among security leaders
Chainguard's AI Exploit Gap report found that 76% of cybersecurity leaders say their organization has experienced, or suspects it has experienced, an AI-driven attack in the last 12 months. Attackers publish malicious packages, hijack trusted ones, and register names of packages that do not yet exist, counting on developers and AI agents to install them unchecked. AI also lets anyone build and publish malicious packages or exploit CVEs and fresh zero-days.
Teams often pin dependencies to specific versions for stability, so CVEs accumulate in those versions. Chainguard also says frontier AI models are uncovering zero-days faster than open source maintainers can fix them.
Go and .NET libraries add malware and greyware scanning
Chainguard Libraries for Go targets cloud and infrastructure development teams. It includes built-in scanning for malware and greyware, which Chainguard describes as a class of nefarious packages that traditional malware scanners miss. Configurable policies let teams block packages that fail security or compliance standards, and the Go product also includes CVE remediation.
Chainguard Libraries for .NET lets organizations on Microsoft and Azure ecosystems replace NuGet with a Chainguard-managed endpoint. It ships with configurable policies and malware and greyware scanning.
JavaScript libraries gain backported fixes for critical and high-severity CVEs
CVE remediation for JavaScript backports upstream fixes for critical- and high-severity vulnerabilities. This helps teams that cannot upgrade immediately reduce known vulnerability risk while planning a major version upgrade. Chainguard says the capability sits on the same endpoint that has blocked every malware attack that has hit npm this year.
Athena intelligence drives same-day zero-day fixes for Java and Python
Chainguard Libraries for Java and Python now include artifacts remediated against vulnerabilities discovered by frontier AI models, available on the day of public disclosure. The protection draws on Athena, Chainguard's industry coalition for the orchestrated defense of open source software. Through Athena's crowdsourced threat intelligence, customers receive novel patches for zero-days found by large institutions pointing frontier AI models at their applications.
Patrick Donahue, SVP of Product at Chainguard, said the product removes the need to trust every installed package, with malware blocked, CVEs fixed without upgrades and zero-days patched on disclosure day.
Kevin Fuller, CISO at Propio, said Chainguard Libraries moved his team from reacting to supply chain attacks to preventing them, because malicious packages never reach the environment.