ActiveState Curated Catalog

What it does

ActiveState Curated Catalog is a software supply chain security product that gives enterprises a private, vetted source for open source components, replacing direct pulls from public registries such as PyPI and npm. Security and engineering teams set policy guardrails at the point of ingestion, while developers and AI coding assistants keep consuming packages through pip, npm, and their existing package managers. Every component is built from original source code in Supply-chain Levels for Software Artifacts (SLSA) Level 3 infrastructure with cryptographic attestation on each artifact.

How it works

The catalog draws on the ActiveState Library, a corpus of 79 million components spanning 12 language ecosystems including Python, Java, JavaScript, Go, R, and .NET. ActiveState compiles each component from source in its hardened build environment, signs it, and delivers native artifacts such as Python wheels and Java JARs into existing artifact repositories. A component-level security feed updates every 24 hours; when an upstream fix lands, affected components are rebuilt and republished under a contractual SLA of 5 business days for critical CVEs and 10 for highs, with breaking-change analysis run before updates ship.

Credentials and traction

SOC 2 Type II certified, with the audit report available through the ActiveState Trust Center. ActiveState was positioned as a Niche Player in the inaugural 2026 Gartner Magic Quadrant for Software Supply Chain Security, and the Curated Catalog was named Best Open Source Security Platform in The Hacker News Cybersecurity Stars Awards 2026. Customers include Barclays, Moody's, Siemens, Druva, and Mercury Financial, and the company has supplied enterprise open source tooling since 1997.