TL;DR
- AI coding tools pull open source dependencies into your build faster than any review process can keep up.
- Software supply chain security tools work at four points: scanners, artifact managers, build provenance tooling, and a curated source for open source.
- Scanners tell you what got in. A curated source decides what gets in, so your scanner has less to find.
- Evaluate tools on five questions: where control sits, how you know where packages came from, who owns remediation, how they fit your workflow, and what evidence they leave for auditors.
- Control at the source. Keep the speed without the remediation bill.
Why software supply chain security got harder
AI coding assistants now suggest and install open source dependencies as part of writing code. One accepted suggestion can bring an entire dependency tree nobody chose, and generated code often skips the manual review that used to catch a bad package.
The exposure behind that speed is broad and growing. 98% of applications include open source components,[1] and detections of malicious open source packages rose 73% in 2025.[2] In ActiveState's research report, The AI Remediation Bill, 94% of respondents say AI has increased their open source consumption.[3]
What's at stake for security leaders
The cost of an unvetted open source component rarely lands in one place. It shows up as rework, release delays, audit findings, and incidents, each in a different team's budget, so no one sees the whole bill.
Regulators expect you to know and control what's in your software. Under the EU Cyber Resilience Act, manufacturers must report actively exploited vulnerabilities and severe incidents from September 11, 2026, with an early warning due within 24 hours.[4] The accountability is personal, too: 78% of CISOs worry about personal liability.[5] What protects you is a defensible record that shows reasonable care.
Where each type of tool fits
Most enterprise stacks already include several of these tools. Each covers a different point in the software supply chain.
Software composition analysis (SCA) scanners. Scanners inventory your open source components and flag known vulnerabilities and license issues. They're the backstop every program needs, and they work on open source after it enters your environment. Keep your scanner. Govern what it scans.
Artifact managers. Artifact managers such as JFrog Artifactory, Sonatype Nexus, Cloudsmith, and AWS CodeArtifact store and proxy the packages your teams use. They're where your developers already pull from, which makes them the natural place to deliver governed open source.
Build provenance tooling. Continuous integration (CI) tooling can sign the artifacts your own pipeline builds and record how each build ran. That covers the code your teams write. The open source packages you consume were built somewhere else, so their provenance has to come from whoever built them.
A curated source. A curated source replaces public registries like PyPI, Maven, and npm as the origin for open source. Developers and AI code generators draw from a private, vetted repository of open source components, so the decision about what's safe is made once, at the source.
How to know where your packages came from
Provenance is the record of where a component came from and how it was built. For the code your teams build, CI tooling can produce it. For the open source you consume, provenance has to exist before the package reaches you, because it can't be reconstructed once a dependency is already in production.
That makes the build origin of your open source a sourcing question. ActiveState builds open source from source in a SLSA Level 3 build environment. Packages arrive with automatically generated software bills of materials (SBOMs), so you know where your packages came from before your developers install them.
Five questions to ask any tool
- Where does control sit? Does the tool decide what can enter your environment, or report on what already has?
- How do you know where packages came from? Can the tool show how open source components were built and where they originated?
- Who owns remediation? When a vulnerability lands, does the work return to your backlog, or does someone deliver the remediated component on a committed timeline?
- How does it fit your workflow? Does it work with the package managers, pipelines, and artifact managers your teams already use, or add a new tool to learn?
- What evidence does it leave? Can you hand an auditor a clear record of component versions, licenses, and security posture over time?
Where ActiveState fits
The ActiveState Curated Catalog is a private, vetted repository of open source components across 10 language ecosystems. It works with the scanner and artifact manager you already run. Developers use native commands such as pip, npm, and maven to pull approved components, so engineering keeps its existing speed.
When AI coding assistants request a dependency, it resolves from the Curated Catalog. Your scanner keeps running, with roughly 68% less noise from false positives.
ActiveState updates managed components on contractual SLAs: 5 business days for critical CVEs, 10 business days for high, and 30 business days for all others, with the clock starting when a fix is available upstream. That's a 90% reduction in mean time to remediation for future vulnerabilities, and developers save about 30% of their time. The same record supports your vulnerability management program and your compliance and SBOM evidence.
The result is less preventable work: fewer release blocks, fewer audit findings, and evidence ready when auditors ask.
Next step
Ready to secure your software supply chain from the source? Contact ActiveState today to see how it works.
Sources
- Black Duck, "2026 Open Source Security and Risk Analysis Report," 2026. https://www.blackduck.com/resources/analyst-reports/open-source-security-risk-analysis.html
- ReversingLabs, "ReversingLabs 2026 Software Supply Chain Security Report Identifies 73% Increase in Malicious Open-Source Packages," January 27, 2026. https://www.reversinglabs.com/press-releases/reversinglabs-2026-software-supply-chain-security-report-identifies-73-increase-in-malicious-open-source-packages
- ActiveState, "The AI Remediation Bill," research by Moving Horizon, September 2026. https://go.activestate.com/ai-remediation-bill
- European Commission, "Cyber Resilience Act: Reporting obligations," Shaping Europe's digital future, 2026. https://digital-strategy.ec.europa.eu/en/policies/cra-reporting
- Splunk, "The CISO Report 2026: From Risk to Resilience in the AI Era," via Help Net Security, February 27, 2026. https://www.helpnetsecurity.com/2026/02/27/splunk-ciso-liability-risk-report/
