Sonatype launches Nexus Repository Pro+ to block malicious components

Sonatype announced Nexus Repository Pro+ on October 14, 2026.

Sonatype said Nexus Repository Pro+ incorporates Sonatype Repository Firewall to evaluate components as they are requested. It blocks or quarantines harmful, vulnerable, or policy‑breaking open‑source packages, AI models, and MCP servers before they enter a build.

Sonatype said Protection comes from Sonatype’s threat intelligence combined with the organization’s own policies. This intelligence stems from Sonatype’s stewardship of Maven Central and the identification of over 1.9 million malicious component versions.

Brian Fox, co‑founder and CTO, explained that the original Nexus aim was to provide developers a reliable base for enterprise‑scale open‑source usage. He added that AI has changed the dependency equation, moving trust decisions to occur before they incorporate a dependency into the build. Fox said this method allows teams to hasten development while retaining control over what they release.

Sonatype said Conventional security scanners often spot problems later in the pipeline, which slows remediation and raises costs. Intercepting threats at the point of entry cuts down on failed builds, emergency upgrades, and unexpected late‑stage issues.

Automated malware and policy checks prevent malicious, vulnerable, or non‑compliant open‑source packages, containers, AI models, and MCP servers from reaching developers, AI agents, or the build.

Organizations can stop unsafe components at the source by applying real‑time intelligence and internal policies, drawing on a catalog of over 333 million components. Sonatype research shows that locating safer upgrade paths can lower residual critical and high risk by 60–70%, with those results then validated and automated.

Continuous guardrails can be embedded directly in development workflows, eliminating the need to route dependency decisions through tickets, approval queues, or separate manual reviews. Together these capabilities make the trusted route the quickest path, supplying human and agentic teams with needed components while blocking known risks downstream.

Sonatype said Cargo, the package manager for Rust, is growing quickly from a modest enterprise foundation. Hugging Face artifacts, though earlier in enterprise uptake, are expanding fastest and are already appearing in security‑policy workflows, showing up in nearly 6% of the measured Nexus Repository population. Organizations adopted Hugging Face nearly 4.7 times more often in Q2 2026 than in Q2 2025.

In a different measured group, approximately 7% of Hugging Face requests were blocked or rejected by policy. In the same population, just over 3.5% of Go requests and 1% of Cargo requests were blocked or rejected by policy.

AI model rejections stemmed mainly from acceptability concerns (55%) rather than security issues (18%). This points out that AI models introduce governance questions that traditional open‑source policies were not designed to handle.

Sonatype said Nexus Repository Pro+ is available as of the announcement date. Nexus Repository Enterprise will add capabilities for large global organizations and will follow in the coming weeks.

More information and a demo request are available at https://www.sonatype.com/products/sonatype-nexus-repository. The research report is available for download at https://www.sonatype.com/resources/reports/beyond-traditional-packages.

Nexus Repository Pro+ applies real-time intelligence along with organizational security, legal, architectural and component-age policies at intake to block unsafe components. Organizations, for example, can validate proposed upgrade paths that are safer against existing build and test processes prior to automating targeted remediation.

Mark Paulsen said TD Bank concentrates on a resilient, secure software supply chain that upholds rigor, reliability, and client confidence. He also noted that Sonatype Repository Firewall functions as the company’s malicious code protection and policy enforcement product.