Integrations / Chainguard

The Chainguard Integration

JFrog and Chainguard help organizations reduce supply chain risk automatically using JFrog's Zero-Touch Remediation, allowing them to build more resilient applications without disruptingRead More >

the developer experience. Chainguard provides malware-free packages across Java, Python, and JavaScript and offers backported versions with critical and high CVE fixes. JFrog Zero-Touch Remediation delivers these packages into customer pipelines. Read Less >

Start Free Book a Demo

Chainguard Integration

Eliminate your malware exposure without new alerts to triage

Chainguard replaces public registries with a secure endpoint where packages pass through multiple layers of defense to prevent malware. Developers avoid needing to review security PRs or false positives as secure-by-default packages now appear as another upstream repository inside of JFrog.

Fix CVEs in hard-to-upgrade versions with verifiable proof

Remediate CVEs in Python and Java packages without relying on runtime patches. This allows your team to stay protected from known vulnerabilities while you plan your next major version upgrade. Every Chainguard-remediated package contains provenance inside the artifact metadata, allowing auditors to run a simple command to verify the fix.

Consume patched artifacts with signed attestations through JFrog

Zero-Touch Remediation swaps your vulnerable packages for Chainguard-remediated versions without breaking your builds. These remediated versions also abide by all of your active JFrog Curation policies.

Close zero-day exposure windows when they become public

JFrog participates in Chainguard’s Athena coalition, which finds, validates, remediates, shields, and surfaces frontier AI model-discovered vulnerabilities ahead of coordinated public disclosure. The JFrog Platform gives mutual customers access to backported fixes for these zero-days on disclosure day, stopping attack paths before bad actors can ever launch their campaign.

Frequently Asked Questions

Do developers need new tooling?

No. Chainguard Libraries present as another upstream repository alongside Maven Central, npm, and PyPI, so builds and environments work as they did before, just now from a secure-by-default, Chainguard-managed endpoint.

Which languages and severities are covered?

Chainguard remediates critical and high-severity CVEs across Python and Java packages. Coverage and maturity differ by ecosystem and are prioritized by severity and package popularity.

What is the JFrog Self-Healing Software Supply Chain Security Ecosystem?

A partnership of open-source security companies delivering a single governed pipeline for provable, auditable remediation at agentic speed. Because JFrog Artifactory is where every artifact lives, JFrog ingests each partner’s fix natively, applies the customer’s policy, and produces one signed evidence chain an auditor can verify. Customers choose the best fix; JFrog delivers the governance.

How does JFrog Zero-Touch Remediation apply a partner’s fix?

Zero-Touch Remediation is an automated, policy-driven engine that matches the right fix to each vulnerable artifact and swaps in the remediated and compliant version without breaking builds, interrupting developers, or requiring a manual version bump. Every action is cryptographically attested through JFrog AppTrust, regardless of which partner produced the fix.

When can we use this?

JFrog Zero-Touch Remediation is open to JFrog Enterprise X customers immediately. Customers can schedule a technical walkthrough and live demonstration through the JFrog self-healing landing page, or register for the post-swampUP webinar on how each ecosystem partner integrates into the JFrog Platform.

About Chainguard

Chainguard is the trusted source for open source. By providing engineers and AI agents with hardened, trusted, and production-ready artifacts, Chainguard helps organizations prevent AI supply chain attacks, increase engineering velocity while reducing toil, and maintain continuous compliance.
Learn More