Andrey Polkovnichenko

JFrog Security Researcher

Andrey is an experienced security and malware researcher with over a decade of expertise in the field. He is passionate about identifying and analyzing various types of bugs and malware across diverse platforms, including mobile devices, embedded systems, and open-source software packages, to make the digital world safer.

The Latest From Andrey Polkovnichenko

Revival Hijack – PyPI hijack technique exploited in the wild, puts 22K packages at risk

September 4, 2024 | 18 min read

JFrog's security research team continuously monitors open-source software registries, proactively identifying and addressing potential malware and vulnerability threats to foster a secure and reliable ecosystem for open-source software development and deployment. This blog details a PyPI supply chain attack technique the JFrog research team discovered had been recently exploited in the wild. This attack technique…
Read More
Binary secret scanning helped us prevent (what might have been) the worst supply chain attack you can imagine

July 9, 2024 | 8 min read

The JFrog Security Research team has recently discovered and reported a leaked access token with administrator access to Python’s, PyPI’s and Python Software Foundation’s GitHub repositories, which was leaked in a public Docker container hosted on Docker Hub. As a community service, the JFrog Security Research team continuously scans public repositories such as Docker Hub,…
Read More
JFrog Security research discovers coordinated attacks on Docker Hub that planted millions of malicious repositories

April 30, 2024 | 19 min read

As key parts of the software ecosystem, and as partners, JFrog and Docker are working together to strengthen the software ecosystem. Part of this effort by JFrog's security research team involves continuous monitoring of open-source software registries in order to proactively identify and address potential malware and vulnerability threats. In former publications, we have discussed…
Read More
NPM Manifest Confusion: Six Months Later

March 26, 2024 | 9 min read

Several months ago, Darcy Clarke, a former Staff Engineering Manager at GitHub, discovered the “Manifest Confusion” bug in the npm ecosystem. The bug was caused by the npm registry not validating whether the manifest file contained in the tarball (package.json) matches the manifest data published to the npm server. Clarke claims this to be a…
Read More

Andrey Polkovnichenko

The Latest From Andrey Polkovnichenko

Revival Hijack – PyPI hijack technique exploited in the wild, puts 22K packages at risk

Binary secret scanning helped us prevent (what might have been) the worst supply chain attack you can imagine

JFrog Security research discovers coordinated attacks on Docker Hub that planted millions of malicious repositories

NPM Manifest Confusion: Six Months Later