Chainguard Joins AWS Security Hub Extended as Supply Chain Partner

Chainguard Libraries enables AWS customers to protect open source dependencies with malware-free packages rebuilt from verified source

KIRKLAND, Wash., Aug. 4, 2026 /PRNewswire/ -- Chainguard, the trusted source for open source, today announced its availability through AWS Security Hub Extended as a Partner in the new Supply Chain category. Through AWS Security Hub Extended, customers can access Chainguard Libraries to help protect against software supply chain threats by replacing public open source dependencies with malware-free, secure-by-default alternatives. This creates a simpler path to reducing software supply chain risk by integrating trusted open source software directly into customers' existing Amazon Web Services (AWS) security operations workflows.

Addressing a growing attack surface in open source software

As AI-assisted attacks continue to increase in frequency and sophistication, organizations face growing risk from compromised open source packages entering development environments. Tools that scan packages at build or runtime are not designed to keep up with the threat. More than 98% of malware ships as a pre-built package with no matching source code — a malicious version goes live, gets pulled into builds around the world within hours, and the damage is done well before any scanner flags it. Chainguard Libraries secures dependencies before they enter customer environments, helping teams move from reactive detection to proactive prevention. Instead of pulling packages directly from public repositories, organizations consume open source packages rebuilt from verified source code in the Chainguard Factory, the company's isolated build environment. This approach helps prevent malicious packages from reaching developers, CI/CD pipelines, and production systems.

"Open source is the foundation the world's software is built on. When that ecosystem gets compromised, the blast radius is enormous," said Patrick Donahue, Senior Vice President of Product, Chainguard. "AWS adding us as a partner for supply chain security with the Extended plan is a real signal that the industry is treating this problem with the seriousness it deserves. Chainguard delivers that protection to customers with open source that's trustworthy by default."

Chainguard's inclusion in AWS Security Hub Extended allows AWS customers to:

• Purchase Chainguard Libraries through their existing AWS contract with no long-term commitment and Enterprise Discount Program (EDP) discounts automatically applied;
• Reduce procurement complexity while preserving direct access to each provider's domain expertise by consolidating solution usage into one bill;
• View centralized findings based on the Open Cybersecurity Schema Framework (OCSF) alongside AWS and partner security findings within Security Hub;
• And receive unified Level 1 from AWS for Enterprise Support customers.

Chainguard's role in AWS Security Hub Extended

Through AWS Security Hub Extended, Chainguard Libraries serves as a malware-free catalog of language dependencies, replacing reliance on public registries like PyPI, Maven Central, and npm. Every package is rebuilt from verified source in Chainguard's SLSA Level 3 build environment and delivered with signed provenance and SBOMs. By preventing malicious packages from entering customer environments and reducing exposure to known Python vulnerabilities, Chainguard helps organizations strengthen software supply chain security while maintaining developer productivity.

AWS customers can access Chainguard Libraries through AWS Security Hub Extended. Log into the AWS Security Hub console and select the Extended plan. Choose Chainguard and follow the guided onboarding experience to subscribe and configure Chainguard Libraries within your environment.

Learn more about Chainguard Libraries at chainguard.dev/libraries. 

About Chainguard
Chainguard is the trust layer for open source software. Its solutions provide engineers and AI agents with the hardened, trusted, and production-ready artifacts they rely on, so organizations can build fast while staying compliant and protecting against AI supply chain attacks. Customers include Fortune 500 enterprises and global industry leaders, including Anduril, Canva, Fortinet, Hewlett Packard Enterprise, OpenAI, Snap Inc., and Snowflake. Chainguard is venture-backed by leading investors, including Amplify, IVP, Kleiner Perkins, Lightspeed Venture Partners, Mantis VC, Redpoint Ventures, Sequoia Capital, and Spark Capital. For more information, visit: https://www.chainguard.dev/ 

Contact: Brittany Hendrickson, [email protected] 

SOURCE Chainguard