Java Product Support Engineer

Sonatype has launched Nexus Repository Pro+, a tool that screens open source packages, AI models, and Model Context Protocol (MCP) servers the moment a developer or AI agent requests them. It automatically blocks or quarantines anything malicious, vulnerable, or out of policy before it reaches a build. The product brings Sonatype Repository Firewall inside the repository. It checks components against Sonatype's threat intelligence and a company's own policies, drawing on a catalogue of more than 333 million components. "Nexus Repository Pro+ puts the trust decision where it belongs — before a dependency reaches the build," said Brian Fox, co-founder and chief technology officer at Sonatype. Pro+ is available now. Nexus Repository Enterprise, aimed at large global organisations, will follow in the coming weeks.

Sonatype unveils Nexus Repository Pro+ to stop malicious components before developers or AI agents pull them into builds. Open source packages, AI models, and MCP servers are screened as soon as developers or AI agents request them, so only trusted components reach the build. Fulton, Md., Oct. 14, 2026 (GLOBE NEWSWIRE) - Sonatype(R), the company helping enterprises build with confidence in the AI era, today announced Nexus Repository Pro+, which stops malicious code where it enters, not after it's already inside. By bringing Sonatype Repository Firewall, the company's malicious code protection and policy enforcement product, inside the repository, Nexus Repository Pro+ screens every open source package, AI model, and Model Context Protocol (MCP) server the moment a developer or AI agent requests it. Anything malicious, vulnerable or out-of-policy is automatically blocked or quarantined before it reaches a build. AI is helping developers write software faster than ever, and AI agents now grab open source packages, AI models, and MCP servers on their own, often without a human reviewing each one. Attackers are exploiting that speed by slipping malicious code into the open source components developers rely on. Nexus Repository Pro+ stops it at the door. Every component is checked against Sonatype's threat intelligence and the organization's own policies. "When we built Nexus, the goal was to give developers a trusted foundation for using open source at enterprise scale," said Brian Fox, co-founder and CTO at Sonatype. "AI changed the equation. Developers and agents are pulling dependencies into builds faster than traditional review processes can manage, and attackers know it. Nexus Repository Pro+ puts the trust decision where it belongs - before a dependency reaches the build, not after it creates downstream rework or release risk. That's how you keep moving faster without giving up control over what you ship." Most security tools find problems further down the pipeline, when those problems are slower and costlier to fix. Catching threats at the point of entry means teams spend less time on failed builds, emergency upgrades, and late-stage release surprises. Automated malware and policy checks block or quarantine malicious, vulnerable, and out-of-policy open source packages, containers, AI models and MCP servers before they reach developers, AI agents or builds. That protection is powered by intelligence unique to Sonatype, informed by its stewardship of Maven Central and its identification of more than 1.9 million malicious component versions. Prevention at the point of entry Nexus Repository Pro+ moves the trust decision to the front of the pipeline while keeping developers and agents in the flow of work. With it, organizations can: * Block unsafe components at the source: Apply real-time intelligence and organizational security, legal, architectural and component-age policies at intake, drawing on a catalog of more than 333 million components to block or quarantine malicious, vulnerable and noncompliant dependencies before they reach developers, AI agents or CI/CD pipelines. * Reduce downstream remediation: Identify safer upgrade paths using real-time intelligence, which Sonatype research found can reduce residual Critical and High risk by 60-70%, then validate proposed changes against existing build and test processes and automate targeted remediation. * Keep protection inside development workflows: Apply continuous guardrails without routing routine dependency decisions through tickets, approval queues or separate manual reviews. Together, these capabilities help organizations make the trusted path the fastest path, giving human and agentic development teams access to the components they need while preventing known risks from spreading downstream. "At TD Bank, we are focused on ensuring our software supply chain is resilient and secure, while maintaining the rigor, reliability, and confidence our clients expect," said Mark Paulsen, Head of the Open Source Program Office at TD Bank. "As AI becomes more embedded in software development and the open source ecosystem, how we set controls and how we govern will be increasingly important in the years ahead. We need to give our development teams the open source guardrails needed to innovate and ship software with confidence in a way that doesn't slow down innovation or take our engineers out of the flow." That need for stronger controls is growing as regulatory expectations rise. For manufacturers of products in scope of the EU Cyber Resilience Act, reporting obligations for actively exploited vulnerabilities and severe incidents took effect September 11, 2026, raising the value of keeping known-bad components out of the software supply chain in the first place. New research reveals a more complex enterprise supply chain A new Sonatype Research Labs report, Beyond Traditional Packages: How Go, Rust, and AI Artifacts are Reshaping Enterprise Dependencies, combines public ecosystem activity with anonymized Nexus Repository adoption and policy telemetry to show how emerging formats are moving into enterprise use. The research found three distinct adoption profiles: * Go is already established across a meaningful share of measured enterprise repositories. * Cargo, the package manager for Rust, is expanding rapidly from a smaller enterprise base. * Hugging Face artifacts remain earlier in enterprise adoption but are growing fastest and are already entering security-policy workflows. Hugging Face appeared in nearly 6% of the measured Nexus Repository population, with nearly 4.7 times as many organizations adopting it in Q2 2026 as in Q2 2025. That adoption is already intersecting with enterprise policy controls. In a separate measured population, nearly 7% of Hugging Face requests were blocked or rejected by policy, compared with just over 3.5% for Go and 1% for Cargo. AI model requests weren't blocked more often because the models are inherently more malicious. Sonatype found that model acceptability accounted for 55% of blocked models, while just 18% were due to security. This signals that AI models raise governance questions traditional open source policies were not designed to address. As software development evolves, enterprise infrastructure must keep pace. Availability Nexus Repository Pro+ is available today. Nexus Repository Enterprise, which extends the same protection with capabilities designed for large, global organizations, will follow in the coming weeks. Download the new Sonatype Research Labs report Beyond Traditional Packages: How Go, Rust, and AI Artifacts are Reshaping Enterprise Dependencies at https://www.sonatype.com/resources/reports/beyond-traditional-packages. About the Research Sonatype Research Labs analyzed public ecosystem data, anonymized Nexus Repository telemetry, and policy activity from measured enterprise environments. Public supply, enterprise adoption, and policy outcomes are distinct measures. Policy activity comes from a separate, smaller set of measured customers than repository adoption; the populations and rates are not directly comparable. Block and rejection rates reflect outcomes in the observed population and may be influenced by customer configuration, request volume, artifact type, and consumption patterns. Data availability, collection windows, and population sizes vary by ecosystem, so comparisons should be made within the periods and populations available for each dataset. About Sonatype Sonatype is the company helping enterprises build with confidence in the AI era. Trusted by thousands of enterprises and millions of developers, Sonatype gives organizations the intelligence and automated governance to manage the open source, AI-generated and third-party components that power modern software. As the steward of Maven Central and the company behind Nexus Repository, Sonatype provides visibility into how software is built, consumed and secured, helping teams accelerate development, reduce risk and deliver secure software at AI scale. To learn more about Sonatype, please visit www.sonatype.com. Sonatype [email protected] Legal Disclaimer: EIN Presswire provides this news content "as is" without warranty of any kind. We do not accept any responsibility or liability for the accuracy, content, images, videos, licenses, completeness, legality, or reliability of the information contained in this article. If you have any complaints or copyright issues related to this article, kindly contact the author above.