Chainguard's beta scanner returns malware verdicts on more than 5,000 Go and .NET packages

The control sits in front of the pull. Chainguard says every dependency pulls through its Chainguard Repository ^[6], which blocks malicious and suspicious packages by building and vetting every artifact it makes available ^[7]. The scanning and the optional cooldown run before a developer, agent or pipeline can fetch anything ^[5]. The company names the targets as malicious typosquats and compromised assemblies ^[10].

The verdict count is Chainguard's own. It says the scanner returned malware verdicts on more than 5,000 .NET and Go packages during the beta ^[8], and that more than 10% of those verdicts had no match in public sources at the time of detection ^[9]. Ten percent of 5,000 is 500, so the floor is more than 500 verdicts where a lookup against public sources would have found nothing when the scanner fired ^[13].

The post does not say how a verdict is confirmed, how the 5,000 split between Go and .NET, or how long the cooldown runs.

In our view this is a product expansion. The post describes one vendor adding two ecosystems to one product ^[1]. It cannot show that cooldowns and pre-pull scanning are spreading across the industry, and we would not read it that way.

The price of the control is an endpoint swap. Chainguard says developers replace standard registry endpoints with its own and pull packages that pass through malware and greyware scanning, alongside configurable organizational policies ^[11]. Go and .NET coverage is early access ^[1].

The same announcement moved Java CVE remediation to general availability, joining Python, and opened betas for JavaScript and Go ^[3]. For those, Chainguard backports critical and high-severity fixes into older versions that customers cannot upgrade from without a breaking change ^[4]. That is a separate line of work from the malware scanning.