Chainguard Libraries expands to Go and .NET

Today at Assemble London, we announced that we’re adding Go and .NET coverage to Chainguard Libraries and expanding our vulnerability remediation capabilities.

With Go and .NET now in early access, we’re providing malware- and greyware-scanned endpoints that also can have a built-in, configurable cooldown to organizations looking to defend against sophisticated and obfuscated AI supply chain attacks. These multiple layers of defense happen before a developer, agent, or pipeline can ever pull a package into an environment. During the Go and .NET beta, our scanner returned malware verdicts on more than 5,000 .NET and Go packages. More than 10% of these verdicts had no match in public sources at the time of detection.

Alongside this ecosystem expansion, we’re elevating Java CVE remediation to general availability to join Python and launching betas for CVE remediation for JavaScript and Go. Like Python and Java, we’re backporting critical and high-severity CVE fixes from upstream versions to older versions our customers cannot upgrade from without causing a breaking change.

Finally, the first wave of Athena disclosures is live, which gives every Chainguard Libraries customer access to pre-patched artifacts that are free of Mythos-discovered vulnerabilities without needing to undergo an emergency upgrade.

These improvements to Chainguard Libraries reflect the growing need for organizations to protect themselves from malware, CVEs, and zero-days as the threats of malicious use of AI continue to grow.

The expanding threat landscape

Frontier AI models give bad actors unprecedented capabilities to weaponize open source software. Seventy-six percent of security leaders faced an AI-driven attack this past year. This comes at a time when unrestricted, open-weight models like GLM-5.3 can achieve a 100% compliance rate for generating cyberattacks. These automated campaigns are flooding public registries with malicious packages and pushing the daily volume of published CVEs up 80% year over year to 240 per day. Simultaneously, the Athena coalition has uncovered more than 21,000 hidden zero-day vulnerabilities buried deep inside popular open source projects.

To safely consume open source software, organizations must build preventative security directly into their language ecosystems. Chainguard Libraries acts as your central, secure catalog for dependencies, replacing vulnerable public endpoints with secure, Chainguard-managed ones. Every dependency pulls through Chainguard Repository, which manages multiple layers of defense:

• First, our platform blocks malicious and suspicious packages by building and vetting every artifact that’s available for consumption, mitigating the risk of credential harvesting and backdoors.

• Second, for known vulnerabilities, we surgically backport fixes into the older library versions you already use, eliminating CVE risk while maintaining application stability.

• Third, we deliver day-zero patched artifacts for novel threats, releasing fixed packages on disclosure day.

Go deeper: New ecosystems and remediation capabilities

The addition of Go and .NET immediately reduces your exposure to malicious typosquats and compromised assemblies. By swapping standard registry endpoints for Chainguard, developers pull packages that pass through strict malware and greyware scanning, alongside configurable organizational policies.

For vulnerability remediation, all patched artifacts are rigorously tested to ensure the vulnerability is remediated while passing all previously successful functional tests. A Chainguard engineer reviews each one before releasing it for widespread consumption.

Engineering teams get clean packages out of the box with Chainguard. This cuts out manual patching, reduces security toil, and frees up sprint time to ship software. With Java and Python in GA (and JavaScript and Go in Beta), every artifact includes verifiable evidence of remediation in its metadata. Instead of burning developer hours on endless triage, teams use Chainguard Libraries to swap in secure, rebuilt packages. They drop right into your environment, quiet your scanners, and keep your audit trail clean.

For JavaScript, remediated versions appear with a X-cgr.N suffix. When developers are building their application, a script updates the lockfile with remediated artifacts when they’re available.

For Go, remediated versions appear with an increased version number and the -cgr.N suffix. This suffix makes the remediation appear as a pre-release and sits between the version you’re stuck on and the next one available. When developers are building their application, they can use a replace directive to update their go.mod file with the remediated libraries available.

Take the CVE we backported in burger/jsonparserv1.1.1. Our remediated artifact is named burger/jsonparserv1.1.2-cgr.1 so that it exists between v1.1.1 and v1.1.2.

If you’re interested in learning more about how Chainguard Libraries protects your dependencies from malware, CVEs, and zero-days, visit the landing page and reach out to our team.