AWS Security Hub adds Supply Chain Security as its 10th category with Chainguard and Socket

AWS added Supply Chain Security as the 10th category in its Security Hub Extended plan, integrating curated partners Chainguard and Socket to help security teams detect and block malicious open-source dependencies before they reach production. The feature scans and gates third-party packages, giving enterprises a managed way to defend against poisoned or typosquatted dependencies within their AWS environments.

The timing is pointed. The same week saw the FaceHugger vulnerabilities disclosed in Hugging Face's Diffusers library (covered separately) and HN discussion of a Shai-Hulud npm supply-chain attack compromising Keyv and related packages — concrete reminders that the open-source dependency graph is a primary attack surface. By partnering with Chainguard (hardened container images) and Socket (dependency risk analysis), AWS is packaging best-of-breed supply-chain tooling into its native security console rather than making customers stitch together point solutions.

The move fits AWS's broader security-and-governance positioning as it courts regulated enterprises — the same pitch behind Bedrock's zero-egress Web Search and S3 Vectors landing in the European Sovereign Cloud. Supply-chain security is increasingly a board-level and compliance requirement, so folding it into Security Hub raises the platform's stickiness. The open question is depth: whether the native integration matches standalone Chainguard/Socket deployments, and how pricing under the Extended plan compares to running these tools independently. Watch adoption among enterprises already anxious after this week's supply-chain incidents.