ActiveState Curated Catalog
Your Private Source for Vetted Open Source
Security and Engineering set the guardrails. Developers and AI coding agents consume through pip, npm, and the package managers they already use. Everyone moves faster.
.webp)
Keep your scanner. Govern what it scans.
Scanners tell you what's already in your code.
The Curated Catalog decides what gets in, so your scanner has less to find and your team has less to triage.
ActiveState handles remediation for you
When an upstream fix is released, ActiveState builds the fixed component from source and publishes it to your catalog. Managed components are updated on contractual SLAs: 5 business days for critical CVEs, 10 business days for high, and 30 business days for all others, with the clock starting when a fix is available upstream.
AI code generators stay on rails
Point your AI coding assistants at the Curated Catalog, and the dependencies they request resolve from your catalog's vetted components instead of public registries.
%20(1).webp)
.webp){kind=logo}
.webp)
Developers keep their existing tools
Packages are delivered as native artifacts like Python Wheels and Java JARs. Your team installs from the Curated Catalog the same way they install from PyPI or Maven. No new CLI. No workflow changes.
Works with Cloudsmith, JFrog Artifactory, Sonatype Nexus, and AWS CodeArtifact
Supports multiple language ecosystems, including Python, Java, and JavaScript
Every component gets a daily security check
Our component-level security feed updates every 24 hours. When a patch drops or a new vulnerability surfaces, you know immediately.
Built from source
ActiveState builds open source from source, with automatically generated SBOMs, so you know where your packages came from.
~68%
reduction in scanner noise from false positives
~30%
of developer time saved
Since 1997
securing open source for enterprises
Supply chain attacks prevented at the source
FAQs
Still have questions?
Talk to our team.
How does a Curated Catalog work with my existing tools?
The Curated Catalog acts as a trusted upstream source for your artifact manager, and works with Cloudsmith, JFrog Artifactory, Sonatype Nexus, and AWS CodeArtifact. Developers keep pulling packages through the tools they already use instead of public registries. AI coding assistants can be pointed at it too, so the dependencies they request resolve from the catalog.
Will a Curated Catalog slow down my developers?
Developers keep their speed. Components arrive pre-vetted, so teams skip the wait for security approvals and spend less time on CVE cleanup. They use the same package managers and the same workflow.
What languages are supported?
The Curated Catalog covers multiple language ecosystems, including Python, Java, JavaScript, and R. See supported languages for the full list.
How quickly does ActiveState remediate vulnerabilities?
Managed components are updated on contractual SLAs: 5 business days for critical CVEs, 10 business days for high, and 30 business days for all others. The clock starts when a fix is available upstream, and the fixed component is published to your catalog.
What does "built from source" mean?
ActiveState builds open source components from their original source code instead of redistributing pre-compiled binaries from public registries, so you know where your packages came from.
Trust what's in your open source before it ships
Book a walkthrough. We'll show you how an ActiveState Curated Catalog fits your stack and your security requirements.
%20(1).webp)