jfrog.com resources | appsec.fyi

jfrog.com

Resources curated from this publisher and indexed across appsec.fyi topic pages. Last item added: 2026-06-25.

Supply Chain 8 AI 7 RCE 2 Deser 1 Python 1

Date Added	Resource	Excerpt
2026-06-25 2026	How JFrog and NanoClaw are Bringing Software Supply Chain Security to the Age of Autonomous AI AI Supply Chain	Library for securing autonomous AI agents, integrating the JFrog Platform with NanoClaw. This solution routes agent requests for packages, CLI tools, and MCP servers through JFrog registries in real-time. JFrog Curation evaluates requests against security policies, blocking compromised dependencies like those with critical CVEs, and enabling agents to automatically install clean alternatives via JFrog Catalog, ensuring continuous workflow with guided self-correction.
2026-06-24 2026	Stop Treating Coding Agent Plugins Like Settings: Introducing Agent Plugins Repositories AI Supply Chain	Library for managing agent plugin repositories, addressing the security risks of uncontrolled distribution channels like GitHub repos and Slack commands. It highlights that plugins are executable software with no inherent versioning, provenance, or audit trail, making them vulnerable to supply-chain attacks similar to those seen with npm packages and Docker images. The library enables signed, immutable releases, unified access control, complete audit trails, and single-copy storage for agent assets, integrating them into existing CI/CD pipelines and offering a governed alternative to Git for hosting these executable assets.
2026-06-23 2026	PixelSmash – Critical FFmpeg Vulnerability Turns Media Files into Weapons RCE	Tool for detecting PixelSmash (CVE-2026-8461), a critical FFmpeg vulnerability enabling remote code execution via crafted media files. This heap out-of-bounds write affects hundreds of applications like Jellyfin, Nextcloud, Kodi, and mpv by exploiting the MagicYUV decoder's handling of slice heights, leading to crashes or arbitrary code execution when processing malicious AVI, MKV, or MOV files.
2026-06-19 2026	npm v12’s Biggest Security Change: From Implicit to Explicit Trust Supply Chain	Library introducing explicit trust for npm package installations in v12, blocking script execution, Git repositories, and remote URLs by default, requiring explicit approval. This change directly addresses common malware delivery mechanisms exploited in campaigns like Shai-Hulud variants and easy-day-js, which leveraged lifecycle scripts, Git dependencies, and remote URLs to steal credentials and compromise developer environments.
2026-06-12 2026	How to Validate Policy-as-Code Without Breaking Builds (Even When AI Writes the Code)AI	Library for validating Open Policy Agent (OPA) Rego policies, particularly those generated by AI tools like Claude Code and Cursor. It offers an AI-assisted authoring capability that translates natural language descriptions into Rego, and a playground for evidence-based validation against real application artifacts pulled from a System of Record. This allows security teams to test policies in a realistic environment before deployment, preventing accidental build breaks and ensuring effective governance.
2026-06-11 2026	Our AI Agent Now Has a Security Conscience: Introducing the JFrog Plugin for Claude Code AI	Plugin for Claude Code that integrates JFrog's Software Supply Chain Platform, providing AI coding agents with real-time security scanning, package safety checks, and governed MCP server management. It enables artifact traceability via JFrog Artifactory, dependency governance through JFrog Curation, and controlled MCP server usage via Agent Guard, ensuring AI-generated code adheres to organizational security and compliance policies by shifting governance earlier in the development workflow.
2026-06-11 2026	The Governance Gap: What IDC’s 2026 Data Reveals About AI and the Software Supply Chain AI Supply Chain	Survey of AI's impact on the software supply chain, revealing that corporate AI adoption is outpacing governance readiness. The IDC 2026 report highlights "Shadow AI" as a significant unmanaged threat, with developers using unvetted tools and AI-generated code. The entry stresses that AI agents cannot self-police compliance and may introduce vulnerable dependencies from repositories like npm or PyPI. The solution involves building platform-level guardrails within the software supply chain to manage AI adoption safely.
2026-06-08 2026	Introducing Package Traffic Controller: Software Supply Chain Security at the Network Edge Supply Chain	Library that enforces software supply chain security at the network edge. Package Traffic Controller intercepts all outbound package download requests, rerouting them transparently through Artifactory for inspection against security, license, and quality policies. This approach prevents shadow downloads from AI agents or other non-development users, ensuring compliance without disrupting developer workflows, and provides auditable logging of all artifact interactions.
2026-06-08 2026	Trusted AI Adoption (Part 2): Detection AI	Library for continuous detection of unmanaged AI assets in agentic supply chains. It addresses the velocity problem of coding agents by implementing deep scanning across binaries, containers, source code, build manifests, and agent configurations. The library classifies discovered assets into Managed, Partially Managed, Unmanaged (Shadow AI), and Malicious categories, enabling automated responses and shifting security from hopeful to enforcement.
2026-06-08 2026	NVIDIA NIM Models Are Now Governed Assets in Your Supply Chain AI Supply Chain	Library for governing NVIDIA NIM models within the software supply chain, integrating them into JFrog Artifactory and JFrog Curation for unified discovery, explicit allow/block policies, and audit trails. This ensures NIM models, like Docker images or npm packages, pass through established security controls, preventing bypass of risk tolerance, licensing, and approval workflows by developers and coding agents.
2026-04-22 2026	Shai-Hulud npm Supply Chain Attack: New Compromised Packages Detected Supply Chain	Writeup on the Shai-Hulud npm supply chain attack details a significant wave of compromised packages, including new variations and obfuscation techniques. Threat actors are targeting popular npm packages to steal credentials from GitHub, NPM, AWS, GCP, and Azure, then exfiltrating this data by creating encoded repositories. The attack utilizes a data-stealer payload bundled within Webpack applications, often disguised as system optimization tools, and employs utilities like TruffleHog to gather secrets.
2026-04-16 2026	Dissecting and Exploiting CVE-2025-62507: RCE in Redis RCE	Writeup of CVE-2025-62507, a stack buffer overflow in Redis's XACKDEL command, details how an attacker can trigger this vulnerability by providing an excessive number of stream IDs. This overflow allows for overwriting the return address on the stack, potentially leading to remote code execution, especially in unauthenticated Redis instances. The analysis demonstrates exploiting this flaw by crashing the server with carefully crafted commands, revealing the path to weaponized exploits.
2026-04-11 2026	XZ Backdoor CVE-2024-3094 - JFrog Supply Chain	Analysis of CVE-2024-3094 details a sophisticated supply chain attack on XZ Utils, versions 5.6.0 and 5.6.1, which allowed unauthorized remote SSH access. The malicious payload, injected into the OpenSSH server (SSHD), modified decryption routines using ChaCha20 and Ed448 signatures to enable attackers with a specific private key to execute arbitrary commands or bypass authentication. The article outlines detection methods, remediation steps including downgrading and system restarts, and a kill switch, along with JFrog OSS tools for vulnerability scanning.
2026-04-10 2026	PyTorch Users at Risk: 3 Zero-Day PickleScan Vulnerabilities \| JFrog Deser Python	Library for detecting vulnerabilities in PyTorch models. JFrog Security Research discovered three zero-day vulnerabilities in PickleScan, the industry-standard tool for scanning pickle-based models. These bypasses, including CVE-2025-10155, allow attackers to embed undetected malicious code within PyTorch models, leading to potential supply chain attacks. PickleScan's reliance on file extension checks over content analysis, and its blacklist approach, create these exploitable gaps.