--- title: ENISA Publishes Technical Advisory on Secure Use of... description: ENISA has published a technical advisory on secure package manager use, timed to help organizations prepare for the EU Cyber Resilience Act (CRA). Starting... canonical: https://daily.dev/posts/enisa-publishes-technical-advisory-on-secure-use-of-package--gyu409m0z twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: ENISA Publishes Technical Advisory on Secure Use of Package ... | daily.dev og:description: ENISA has published a technical advisory on secure package manager use, timed to help organizations prepare for the EU Cyber Resilience Act (CRA). Starting... og:url: https://daily.dev/posts/enisa-publishes-technical-advisory-on-secure-use-of-package--gyu409m0z og:image: https://api.daily.dev/og/posts/gYu409M0Z.png og:image:alt: ENISA Publishes Technical Advisory on Secure Use of Package ... og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # ENISA Publishes Technical Advisory on Secure Use of Package ... **[Socket](https://daily.dev/sources/socketdev)** · 6 min read · 0 upvotes · 0 comments ## Summary ENISA has published a technical advisory on secure package manager use, timed to help organizations prepare for the EU Cyber Resilience Act (CRA). Starting September 11, 2026, companies must report actively exploited vulnerabilities, with full supply chain obligations kicking in by December 2027. The advisory covers the full lifecycle of dependency consumption: selecting, integrating, monitoring, and responding to vulnerabilities. Key practices include SBOM generation, continuous dependency monitoring, provenance verification, and reachability analysis. Non-compliance can result in fines up to €15 million or 2.5% of global turnover, and products can be pulled from the EU market. The open source community had earlier raised concerns about the CRA treating volunteer contributors as commercial suppliers, but revisions exempted non-commercial developers while still holding companies accountable for open source components they ship. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Similar posts on daily.dev - [EU rules on securing IT products could affect open source software users beginning this week](https://daily.dev/posts/eu-rules-on-securing-it-products-could-affect-open-source-software-users-beginning-this-week-loj2t8f8z) · InfoWorld · 1 upvotes · 0 comments - [EU Cyber Resilience Act \(CRA\): Overview](https://daily.dev/posts/eu-cyber-resilience-act-cra-overview-2thbpzeiw) · Docker · 0 upvotes · 0 comments - [EU’s Cyber Resiliency Act will put IT leaders to the test](https://daily.dev/posts/eu-s-cyber-resiliency-act-will-put-it-leaders-to-the-test-ufqkjfyfz) · CSO Online · 0 upvotes · 0 comments - [Making the Cyber Resilience Act Work for Open Source](https://daily.dev/posts/making-the-cyber-resilience-act-work-for-open-source-ri1ckviqk) · The New Stack · 0 upvotes · 0 comments - [Taking Stock of the State of European Cyber Resilience Act \(CRA\) Compliance: An Urgent Wake-up Call for the Open Source Ecosystem](https://daily.dev/posts/taking-stock-of-the-state-of-european-cyber-resilience-act-cra-compliance-an-urgent-wake-up-call--6yezrqnee) · Linux Foundation · 0 upvotes · 0 comments --- Tags: [#sbom](https://daily.dev/tags/sbom) [View this post on daily.dev](https://daily.dev/posts/enisa-publishes-technical-advisory-on-secure-use-of-package--gyu409m0z) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"ENISA Publishes Technical Advisory on Secure Use of Package ...","url":"https://daily.dev/posts/enisa-publishes-technical-advisory-on-secure-use-of-package--gyu409m0z","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/enisa-publishes-technical-advisory-on-secure-use-of-package--gyu409m0z"},"datePublished":"2026-03-19T18:02:29.109Z","dateModified":"2026-03-19T18:02:54.197Z","description":"ENISA has published a technical advisory on secure package manager use, timed to help organizations prepare for the EU Cyber Resilience Act (CRA). Starting...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/3a892e030884c3308d4212aab7855a7c?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/3a892e030884c3308d4212aab7855a7c?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Socket","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Socket","logo":"https://media.daily.dev/image/upload/s---oEn9czC--/f_auto/v1716187892/logos/socketdev","url":"https://daily.dev/sources/socketdev"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/enisa-publishes-technical-advisory-on-secure-use-of-package--gyu409m0z","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"sbom","timeRequired":"PT6M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Socket","item":"https://daily.dev/sources/socketdev"},{"@type":"ListItem","position":3,"name":"ENISA Publishes Technical Advisory on Secure Use of Package ..."}]} ```