Hopper Launches SUPPLYSHIELD™: A Secure Open Source Supply Layer Delivering Zero-CVE, Malware-Free Components Through a Trusted Registry

NEW YORK, April 3, 2026 /PRNewswire/ -- Hopper today announced the launch of SUPPLYSHIELD™, a new software supply layer that enables organizations to consume open source through a secured and continuously maintained registry, delivering components with zero known vulnerabilities and no malicious code across any library and any version.

Open source software powers nearly every modern application, yet recent supply chain attacks have exposed a critical weakness in how it is consumed. In just the past week, incidents involving widely used tools and packages, including Trivy, Axios, LiteLLM, Checkmarx KICS, and Telnyx, have demonstrated that compromised or malicious code can propagate through trusted ecosystems before organizations have visibility or control.

At the same time, more than 20,000 new vulnerabilities are disclosed every year, and the time between disclosure and exploitation has dropped to days. Public data sources such as Zero Day Clock show how quickly newly discovered vulnerabilities are weaponized, with exploitation often following disclosure almost immediately. With AI accelerating both discovery and attack development, the traditional reactive model is no longer viable.

Today, organizations still pull components directly from public registries, assume they are safe, and deal with the consequences later. Vulnerabilities are discovered after deployment, remediation introduces risk, and engineering teams are forced into constant tradeoffs between security and delivery.

SUPPLYSHIELD replaces this model entirely.

Instead of consuming open source from public sources, organizations pull components from Hopper's trusted registry, where every package is verified, remediated, and continuously maintained before it ever reaches production.

This creates a fundamentally different way to consume open source. Rather than inheriting risk and managing it internally, organizations rely on a supply layer where:

• Every component is verified to ensure it does not contain malicious code
• Every version is continuously remediated to eliminate known vulnerabilities
• Every dependency, including transitive dependencies, is maintained and secured
• Every change is fully transparent, with code diffs, build logs, and validation evidence

Similar to how enterprises rely on vendors like Red Hat to provide a trusted and maintained operating system, Hopper extends that model to the entire open source ecosystem.

"For the first time, open source can be consumed without introducing risk into the business," said Roy Gottlieb, Co-Founder and CEO of Hopper. "We ensure that every component you use is safe, continuously maintained, and ready for production. That means no fire drills, no delays to releases, and no engineering time spent chasing vulnerabilities. Teams stay focused on building, while we take full responsibility for the software supply chain."

SUPPLYSHIELD combines large-scale AI systems with human validation to maintain secure versions of libraries across the full dependency tree. When new vulnerabilities are disclosed, the platform delivers remediated components within 24 hours, allowing organizations to keep pace with an increasingly accelerated threat landscape.

The platform is already in use by multiple Fortune 500 organizations to maintain secure and compliant software environments while significantly reducing engineering overhead.

As regulatory pressure increases across FDA, FedRAMP, PCI DSS, and the Cyber Resilience Act (CRA), unpatched vulnerabilities are directly impacting approvals, compliance, and revenue, driving organizations toward architectures that enforce security by design rather than relying on reactive controls.

SUPPLYSHIELD represents that shift.

For more information, visit https://hopper.security.

About Hopper

Hopper is building the maintenance and trust layer for open source software, enabling organizations to consume components through a secured, continuously maintained registry that eliminates software supply chain risk.

Media contact: [email protected]

SOURCE Hopper