Browse malware info in the console (#3645)

[ ] Check if this is a typo or other quick fix and ignore the rest :)

## Type of change
Update to Libraries Browse and Platform Chainguard Console pages

### What should this PR do?
Explain malware browsing in console for libraries, and cross-link the
console content for containers and libraries

### Why are we making this change?
Product update

### What are the acceptance criteria? 
Content should be clear and accurate

### How should this PR be tested?

Any documentation published to Chainguard Academy is reviewed carefully
for accuracy. GUI procedures, API commands, and CLI code snippets in a
draft are run and tested thoroughly — by both the author and the
reviewer — to confirm they work exactly as written. This helps ensure
that readers can follow along and get the same results. See the [`edu`
repo's README](https://github.com/chainguard-dev/edu#testing).

Log in to the console with feature flag enabled for malware, view the
library ecosystem pages

---------

Signed-off-by: s-stumbo <sally.stumbo@chainguard.dev>
Signed-off-by: s-stumbo <100295939+s-stumbo@users.noreply.github.com>
Co-authored-by: angela-zhang <30538317+angela-zhang@users.noreply.github.com>

Author: s-stumbo

content/chainguard/libraries/browse.md

@@ -4,7 +4,7 @@ linktitle: "Browsing"
 description: "Searching, browsing, and inspecting Chainguard Libraries in the console"
 type: "article"
 date: 2025-07-03T14:00:00+00:00
-lastmod: 2025-07-03T14:00:00+00:00
+lastmod: 2026-07-30T14:25:45+00:00
 draft: false
 tags: ["Chainguard Libraries"]
 menu:
@@ -14,19 +14,22 @@ weight: 007
 toc: true
 ---
 
-Chainguard Libraries includes thousands of libraries and many more individual
-library versions and artifacts. Through the Chainguard Console, you can
-browse all available libraries and their versions, and inspect their
-characteristics before using them in your application development.
+Chainguard Libraries is a malware-free catalog of Java, JavaScript, and Python
+artifacts that have passed through multiple layers of security controls,
+including malware and greyware scanning, building from source, cooldowns, and
+additional policies.
+
+In the Chainguard Console, you can browse available
+libraries and versions, inspect package details, and evaluate dependencies
+before pulling them into your environment.
 
 ## Access libraries in the Chainguard Console
 
 Log in to the Chainguard Console at
 [https://console.chainguard.dev/](https://console.chainguard.dev/).
 
 In the left-hand navigation under **Libraries**, expand **Ecosystems** to find
-links for browsing Chainguard's [**Java**](/chainguard/libraries/java/overview/)
-and [**Python**](/chainguard/libraries/python/overview/) libraries.
+links for browsing Chainguard's [**Java**](/chainguard/libraries/java/overview/), [**JavaScript**](/chainguard/libraries/javascript/overview/), and [**Python**](/chainguard/libraries/python/overview/) libraries.
 
 <a id="initial-display"></a>
 
@@ -37,20 +40,24 @@ libraries. Click any row to open the [library detail page](#library-page).
 
 The list includes the following columns:
 
-* **Name** - the full library name, excluding any version identifiers.
+* **Name**: The full library name, excluding any version identifiers.
     * Python library names are simple strings, such as `setuptools` or
   `Flask-Admin`.
     * Java library names are the concatenation of the Maven
   coordinate values `groupId` and `artifactId`, separated by `:`. Examples are
   `org.springframework:spring-core` or `org.eclipse.jetty:jetty-http`.
-* **Latest version** - the latest released and available version of the library
+* **Latest version**: The latest released and available version of the library
   and the total number of available versions.
-* **Updated** - The most recent date when any version of this library was built
-  and published by Chainguard.
+* **Updated**: The most recent date when any version of this library was built
+and published by Chainguard, or cached from the upstream fallback (when upstream fallback is enabled).
 
 At the bottom of the page, see a total count of available libraries.
 
-As a part of Chainguard Repository, [upstream fallback and policy controls](/chainguard/libraries/overview/#upstream-fallback-and-controls) are available for Chainguard Libraries and can be enabled via `chainctl` commands. For JavaScript, you can also enable upstream fallback in the Chainguard Console.
+#### Upstream fallback details
+
+The upstream fallback is available for JavaScript, Python, and Java Libraries. The upstream fallback can be enabled or disabled using the `chainctl libraries entitlements` commands, per ecosystem. Currently, the Chainguard Console can be used to enable, disable, and view the status of the upstream fallback for JavaScript only. At the top of the JavaScript page in the Console, you can see whether [upstream fallback](/chainguard/libraries/overview/#upstream-fallback-and-controls) is enabled.
+
+Learn more in the [Libraries Overview documentation](/chainguard/libraries/overview/#upstream-fallback-and-controls).
 
 When fallback is configured for your organization, you will see all JavaScript packages -- including those built by Chainguard and those that are mirrored from upstream npm -- in the Console. For a given package, you can see whether it is being served from Chainguard's rebuilt artifacts or proxied from upstream npm. For Java and Python, you cannot currently view upstream vs. Chainguard-built packages via the Chainguard Console.
 
@@ -68,10 +75,10 @@ Click into a row to view a [specific library page](#library-page).
 ### View remediated libraries
 
 [CVE remediation](/chainguard/libraries/cve-remediation/) is available for a
-subset of Chainguard Libraries for Python. You can view remediated libraries in
+subset of Chainguard Libraries for Java (available in beta) and Python. You can view remediated libraries in
 the Chainguard Console.
 
-In the Python libraries directory, click the **Remediated** tab to view a list
+In the Java and Python libraries directories, click the **Remediated** tab to view a list
 of remediated libraries. Click into a library to see which versions have
 remediated CVEs.
 
@@ -82,6 +89,27 @@ version was patched, and links to additional resources.
 Learn more about browsing remediations in [CVE remediation for Chainguard
 Libraries](/chainguard/libraries/cve-remediation/#about-cve-remediation).
 
+### View malware information
+
+For the JavaScript and Python ecosystems, click the **Malware** tab to learn how many packages have been blocked by Chainguard due to [malware or greyware detection](/chainguard/libraries/overview/#malware-and-greyware-detection).
+
+The list at the bottom of the page displays automatically blocked packages, including the package name, blocked version(s), the date it was blocked on, its MAL ID if available, and signals detected.
+
+#### Malware and greyware signals detected
+
+Some signals describe confirmed malicious behavior, while others describe greyware or supply-chain risk indicators that may justify blocking even when there is no public malware advisory. Next to each blocked package, Chainguard provides the reason it was blocked when there is no public malware advisory. The detected signals fall under the following categories:
+
+* **Credential and data theft**: The package harvests secrets (for example, GitHub tokens or SSH keys) and sends sensitive data out of the environment.
+    * Signals: Accesses credentials, Data exfiltration, Contains an exposed secret
+* **Backdoors and malicious behavior**: The package obfuscates malicious behavior, including backdoor setup, remote access, staged payloads, and more. The code may contact known malicious infrastructure to fetch or run additional payloads.
+    * Signals: Suspicious execution technique, Obfuscated or hidden payload, Cryptomining, Spreads to other packages (worm), Embedded binary in source, AI/LLM attack content, Suspicious network activity, Contacts known-malicious infrastructure, Linked to known malware
+* **Install-time script execution**: The package automatically executes malicious behavior through pre-install and post-install lifecycle scripts.
+    * Signals: Malicious install script, Declares install scripts
+* **Typosquatting and impersonation**: The package is named or brand-engineered to deceive users into downloading the wrong package.
+    * Signals: Typosquatting or impersonation, Dependency confusion
+* **Compromised or untrusted releases**: The package exhibits signs that a release cannot be trusted.
+    * Signals: Signs of maintainer account compromise, No trusted provenance or signed release, Published with a legacy token (not OIDC), Release integrity anomaly, Anomalous release change, Anomalous package contents, Weak build-pipeline security, Untrusted dependency source
+
 ## Library page
 
 To access a library page, click on the row for a specific library in the search
@@ -106,3 +134,8 @@ Click on the column titles to change the **sort** order of the list.
 ## View repository configuration in the Chainguard Console
 
 The Chainguard Console provides visibility into your repository configuration and the packages being served. When the upstream fallback is configured for your organization, you will see all packages including those built by Chainguard and those that are mirrored from upstream npm.
+
+## Other resources
+
+* [Chainguard Console](/platform/console/): Learn about using the Chainguard Console to browse container images.
+* [Libraries Overview](/chainguard/libraries/overview/): Learn about criteria for building a library, upstream fallback and policy controls, and more.

content/chainguard/libraries/overview.md

@@ -6,7 +6,7 @@ description: "Learn about Chainguard Libraries, providing enhanced security for
     comprehensive supply chain protection."
 type: "article"
 date: 2025-03-25T08:04:00+00:00
-lastmod: 2026-08-03T14:51:58+00:00
+lastmod: 2026-07-30T14:25:45+00:00
 draft: false
 tags: ["Chainguard Libraries", "Overview"]
 menu:
@@ -188,25 +188,13 @@ on subsequent requests.
 
 Chainguard's scanning evaluates multiple signal types, including:
 
-* **Maintainer behavior**: Flags anomalies in publisher accounts, release
-  history, and package metadata, checking to see if a maintainer account was
-  recently transferred, if a version was quietly yanked and republished, or if a
-  publish timestamp falls outside any normal window. It also monitors for
-  changes in publishing policy, process, or toolchain as these updates can be an
-  indicator of ownership takeover.
-* **Package contents**: Downloads and scans the actual package that was
-  published for obfuscated code, embedded C2 domains, modified binaries, and
-  other indicators that something fishy was inserted into the package before it
-  hit the registry. It also triggers on newly added dependencies and significant
-  changes in code or binary size.
-* **Publishing signals**: Compares the published package against its source
-  code, providing extra protection for all of the packages served via
-  Chainguard’s upstream fallback. It also monitors for items such as a release
-  not being tagged or being signed with an unknown key. Other publish signals
-  include force pushing a tag or a commit hash not being in the event log.
-* **Dynamic execution**: Runs install scripts in a sandboxed, network-blocked
-  environment to see if there are attempts to call out to an external server,
-  read system files, or execute hidden payloads.
+* **Credential and data theft**: The package harvests secrets (for example, GitHub tokens or SSH keys) and sends sensitive data out of the environment.
+* **Backdoors and malicious behavior**: The package obfuscates malicious behavior, including backdoor setup, remote access, staged payloads, and more. The code may contact known malicious infrastructure to fetch or run additional payloads.
+* **Install-time script execution**: The package automatically executes malicious behavior through pre-install and post-install lifecycle scripts.
+* **Typosquatting and impersonation**: The package is named or brand-engineered to deceive users into downloading the wrong package.
+* **Compromised or untrusted releases**: The package exhibits signs that a release cannot be trusted.
+
+You can view blocked packages [in the Chainguard Console](/chainguard/libraries/browse/#view-malware-information) or [using `chainctl` commands](/chainguard/libraries/access/#check-blocked-packages).
 
 #### Malware API
 

content/platform/console/images-directory/index.md

@@ -6,7 +6,7 @@ aliases:
 type: "article"
 description: "A walkthrough of the Chainguard Console."
 date: 2024-02-23T11:07:52+02:00
-lastmod: 2026-03-16T08:07:42+02:00
+lastmod: 2026-07-24T15:09:10+00:00
 draft: false
 tags: ["Chainguard Containers"]
 images: []
@@ -31,7 +31,11 @@ If you would like to open the console with your Organization already selected, y
 https://console.chainguard.dev/auth/login?org=ORGANIZATION
 ```
 
-## Browse container images and details in the console
+## Browse Chainguard Libraries in the console
+
+Learn more browsing Chainguard Libraries in the console on the [Libraries Browsing page](/chainguard/libraries/browse/).
+
+## Browse container images and details in the Console
 
 After signing in to the [Chainguard Console](https://console.chainguard.dev), your browser will take you to the Overview page. The following screenshot shows the Overview Page for an organization that hasn't paid for access to any container images: