Introduction to Chainguard Libraries on

Chainguard Libraries overview

Tue, 25 Mar 2025 08:04:00 +0000

Chainguard Libraries is a secure catalog of language dependencies that replaces your team’s reliance on npm, PyPI, and Maven Central. Every package pulled by your team or AI agents passes through multiple layers of defense, including malicious behavior scanning, building from source, and cooldowns that help prevent malware from entering your environment.

As frontier coding models advance, attackers are creating more sophisticated social engineering campaigns and malware injections to exfiltrate enterprise secrets. Chainguard Libraries prevents malware instead of making developers pause work, triage incidents, and respond after compromise.

Quickstart for Chainguard Libraries

Tue, 25 Mar 2025 00:08:04 +0000

Most supply chain attacks succeed the same way: malicious code is injected into a package after the source is written — either as a backdoored binary with no verifiable source, or as a malicious install-time script that runs the moment a dependency is pulled. Recent attacks on LiteLLM, Telnyx, and Axios all followed this pattern.

Chainguard Libraries for Java, JavaScript, and Python are rebuilt from verified source in an isolated build environment, making them malware-resistant by design. When a package is available as a Chainguard-built library, that rebuilt package is served first. When you use the upstream fallback, the same ecosystem endpoint can also serve eligible upstream packages that Chainguard has not yet built, subject to configurable policy controls such as cooldown and malware scanning. This gives your engineers drop-in replacements for the packages they already use, with no breaking changes.

Chainguard Libraries access

Tue, 25 Mar 2025 00:08:04 +0000

Chainguard Libraries provide controlled access to security-enhanced Java and Python dependencies through the unified Chainguard platform authentication system. This guide explains how to access (download) Chainguard library artifacts for your organization.

Getting started

Prerequisites

Ensure you have access to Chainguard Libraries.
- If you are not a Chainguard user yet, a new Chainguard account must be created and you must add an entitlement to Chainguard Libraries.
Confirm the name of your organization so you can use it with the --parent parameter to specify your organization when running commands with chainctl.

Direct access vs. artifact manager

There are two approaches to access: Using an artifact manager or direct access.

Chainguard Libraries network requirements

Wed, 04 Jun 2025 09:30:00 +0000

Chainguard Libraries require specific network access to ensure secure delivery of hardened dependencies to your development environment. This guide details the domains and ports needed for authentication, package downloads, and verification tools.

Access for chainctl and other tools

For initial configuration with chainctl and for in-process verification of downloaded libraries, you must allow HTTPS access to the following domains:

Browsing Chainguard Libraries

Thu, 03 Jul 2025 14:00:00 +0000

Chainguard Libraries is a malware-free catalog of Java, JavaScript, and Python artifacts that have passed through multiple layers of security controls, including malware and greyware scanning, building from source, cooldowns, and additional policies.

In the Chainguard Console, you can browse available libraries and versions, inspect package details, and evaluate dependencies before pulling them into your environment.

Access libraries in the Chainguard Console

How does Chainguard Libraries plug into a developer's workflow?

Sat, 02 Aug 2025 16:00:00 +0000

Transcript

Interviewer: So Dustin, how does Libraries actually plug into a developer workflow?