Back
JFrog Guy__Korolevski_headshot1

Guy Korolevski

JFrog Security Researcher
Guy is a malware security researcher at JFrog with over 6 years of specialized experience in software supply chain attacks, advanced malware analysis, and automated threat detection. Before assuming this role, he gained valuable insights as a Security Researcher and Software Engineer, holding a Bachelor of Science degree in Physics.

The Latest From Guy Korolevski

  • The Perfect Heist: NuGet Typosquat Targets Betting Platform to Rig Results
    | 14 min read

    The JFrog Security Research team has discovered and disclosed a typosquatted NuGet package named Newtonsoftt.Json.Net. Note the double t and the .Net suffix.  This package has been masquerading as the popular Newtonsoft.Json library while quietly shipping a trojanized fork. The trojan rigs Digitain, an online betting platform, and in later generations, exfiltrates rigged round results…

    Read More

  • npm v12’s Biggest Security Change: From Implicit to Explicit Trust
    | 14 min read

    For years, installing an npm package has meant trusting that every package in the dependency tree will behave as expected. Whether code originated from the npm registry, a Git repository, a remote URL, or an installation script buried deep within a transitive dependency, npm would typically execute or retrieve it automatically during the installation process.…

    Read More

  • Breaking AppSec Myths – Obfuscated Packages
    | 15 min read

    As part of the JFrog Security Research team’s ongoing work, we continuously monitor newly published packages across multiple ecosystems for malicious activity. This effort serves the broader open source community through public research disclosures, and it directly impacts the detection capabilities behind JFrog Xray and JFrog Curation. Our scanning pipeline uses a broad set of…

    Read More

  • 8 Malicious npm Packages Deliver Multi-Layered Chrome Browser Information Stealer
    | 7 min read

    Open-source software repositories have become one of the main entry points for attackers as part of supply chain attacks, with growing waves using typosquatting and masquerading, pretending to be legitimate. The JFrog Security Research team regularly monitors open-source software repositories using advanced automated tools, in order to detect malicious packages. In cases of potential software…

    Read More

  • Multi-Stage Malware Attack on PyPI: Malicious Package Threatens Chimera Sandbox Users
    | 8 min read

    Update 25/06/2025: After the publication of our blog, JFrog was contacted by a security team and was informed that the PyPI package was published as part of an internal security audit - "The PyPI package was not created with malicious intent and users were not targeted by unknown threat actors, the purpose of this simulation…

    Read More

  • Malicious PyPI Package Hijacks MEXC Orders, Steals Crypto Tokens
    | 10 min read

    The JFrog Security Research team regularly monitors open source software repositories using advanced automated tools, in order to detect malicious packages. In cases of potential supply chain security threats, our research team reports any malicious packages that were discovered to the repository’s maintainers in order to have them removed. This blog provides an analysis of…

    Read More