Chainguard – Weekly Recap

Chainguard featured prominently this week with a series of product, customer, and security updates underscoring its focus on software supply chain protection. The company highlighted that project management platform Asana achieved a reported 99.8% reduction in software vulnerabilities after standardizing on Chainguard Containers, supporting Asana’s FedRAMP accreditation efforts for U.S. federal work.

Chainguard framed the Asana engagement as turning intensive compliance obligations into a go-to-market advantage, suggesting its hardened images can help customers meet security baselines while accelerating federal-market access. The case study, along with additional customer stories involving Cloudera and Appian, points to growing enterprise traction in highly regulated segments.

On the product front, Chainguard expanded its presence on AWS by launching five hardened Amazon EKS add-ons in AWS Marketplace, covering kube-proxy, CoreDNS, VPC CNI, EBS CSI, and EFS CSI. These zero-known-CVE, FIPS 140-3 validated images target organizations pursuing FedRAMP, HIPAA, PCI-DSS and similar regimes, allowing them to harden Kubernetes infrastructure without abandoning AWS-native procurement and operations.

The company emphasized that these EKS add-ons integrate into existing self-managed clusters, reducing the need for in-house image hardening and ongoing maintenance. Chainguard positioned the launch as reinforcing its broader catalog of more than 2,300 minimal, continuously rebuilt container images with SBOMs and verifiable signatures, aimed at customers facing increasing AI-driven vulnerability discovery and nation-state threats.

Security incidents across open-source ecosystems also spotlighted Chainguard’s detection capabilities. The firm reported that its Factory system detected and blocked malicious npm packages linked to an SAP ecosystem attack, terminating workflows when a Bun-based credential harvester attempted to execute via preinstall hooks and keeping Chainguard Libraries and Containers unaffected.

In a separate incident, Chainguard said its tooling identified a compromised version of the elementary-data Python package, flagging obfuscated command-and-control code in version 0.23.3 while steering users to safe releases such as version 0.23.4. These responses support the company’s narrative that automated build and verification pipelines can provide tangible resilience benefits for customers relying on open-source components.

The company’s April roundup highlighted internal research showing a 145% quarter-over-quarter increase in unique CVEs, underscoring a rapidly expanding vulnerability landscape. Chainguard also noted a collaboration with AI coding platform Cursor to ensure that AI-generated code is built on trustworthy open-source components, aligning its supply chain security strengths with emerging AI development workflows.

Beyond products and security events, Chainguard announced the opening of a New York City office while maintaining a remote-first operating model, signaling measured investment in physical space to support growth, talent, and culture. Overall, the week’s developments reinforced Chainguard’s positioning as a security-first supplier for regulated cloud-native workloads, with expanding partnerships, customer references, and marketplace integrations bolstering its competitive profile.