Welcome to the JFrog Blog

Latest:

The Perfect Heist: NuGet Typosquat Targets Betting Platform to Rig Results

July 21, 2026 Guy Korolevski, JFrog Security Researcher

14 min read

The JFrog Security Research team has discovered and disclosed a typosquatted NuGet package named Newtonsoftt.Json.Net. Note the double t and the .Net suffix.  This package has been masquerading as the popular Newtonsoft.Json library while quietly shipping a trojanized fork. The trojan rigs Digitain, an online betting platform, and in later generations, exfiltrates rigged round results…

Read More

All Blogs

Secure AI Workflows: The Identity and Access Management (IAM) Checklist

Secure AI Workflows: The Identity and Access Management (IAM) Checklist

July 8, 2026 Mika Lanir, JFrog Technical Writer Sean Pratt, JFrog Director of Product Marketing | 6 min read

AI agents and LLMs are already building, analyzing, and deploying code across your software development lifecycle. As software supply chains become increasingly AI-driven, proactive security and access controls are your only path to success. To effectively govern authentication and permissions without sacrificing development speed, you must update your access management strategies. By securing the AI…
Read More
Beyond Tokens SF: Best Ideas of the Evening

Beyond Tokens SF: Best Ideas of the Evening

July 7, 2026 The JFrog Team | 5 min read

AI agents are changing how software gets built, but the infrastructure around them hasn't caught up. Agents burn through tokens on noise. They take actions they shouldn't. Context evaporates between releases. And most delivery pipelines were never designed for the pace and volume of agentic development. On June 11th we brought together developers in San…
Read More
Where Severity Scores Go Wrong: “Just Add Prototype Pollution”

Where Severity Scores Go Wrong: “Just Add Prototype Pollution”

July 1, 2026 Tamir Friedman, JFrog Security Researcher Ofri Ouzan, JFrog Security Researcher | 11 min read

At JFrog, our Security Research team continuously monitors and analyzes newly disclosed CVEs across the open-source ecosystem. Throughout our research, we have repeatedly observed cases where the assigned severity score does not accurately reflect a vulnerability's real-world impact or exploitability. In fact, during 2025, JFrog researchers reassessed NVD critical-severity vulnerabilities and concluded that 96% warranted…
Read More
JFrog Named a Leader in the Inaugural Gartner<sup>®</sup> Magic Quadrant™ for Software Supply Chain Security

JFrog Named a Leader in the Inaugural Gartner® Magic Quadrant™ for Software Supply Chain Security

June 18, 2026 The JFrog Team | 5 min read

The recognition is new; the commitment behind it isn't. It's official. Gartner just published the very first Gartner® Magic Quadrant™ for Software Supply Chain Security, and JFrog has been recognized as a Leader, placing highest for Ability to Execute among all the vendors included. For an inaugural report in a category this important, that placement…
Read More
How JFrog and NanoClaw are Bringing Software Supply Chain Security to the Age of Autonomous AI

How JFrog and NanoClaw are Bringing Software Supply Chain Security to the Age of Autonomous AI

June 24, 2026 Gal Marder, JFrog Chief Strategy Officer | 5 min read

There's a category of security risk that most organizations aren't ready for. It doesn't live in your code repository, your CI pipeline, or your developer laptops. It lives in your runtime, in the autonomous AI agents already running in your environment, extending their own capabilities, and making decisions that no human explicitly approved. This is…
Read More
PixelSmash – Critical FFmpeg Vulnerability Turns Media Files into Weapons

PixelSmash – Critical FFmpeg Vulnerability Turns Media Files into Weapons

June 22, 2026 Yuval Moravchick, JFrog Vulnerability Research Team Lead Ori Hollander, JFrog Security Researcher | 23 min read

JFrog Security Research recently discovered and disclosed a critical vulnerability in FFmpeg, the world's most widely deployed media processing framework. The discovered vulnerability, which we've named PixelSmash, is CVE-2026-8461 - a heap out-of-bounds write in the MagicYUV decoder (CVSS 8.8 High). We escalated this vulnerability from a simple crash all the way to reliable remote…
Read More
npm v12’s Biggest Security Change: From Implicit to Explicit Trust

npm v12’s Biggest Security Change: From Implicit to Explicit Trust

June 18, 2026 Ofri Ouzan, JFrog Security Researcher Guy Korolevski, JFrog Security Researcher | 14 min read

For years, installing an npm package has meant trusting that every package in the dependency tree will behave as expected. Whether code originated from the npm registry, a Git repository, a remote URL, or an installation script buried deep within a transitive dependency, npm would typically execute or retrieve it automatically during the installation process.…
Read More
How to Validate Policy-as-Code Without Breaking Builds (Even When AI Writes the Code)

How to Validate Policy-as-Code Without Breaking Builds (Even When AI Writes the Code)

June 11, 2026 Segev Sharabi, JFrog Senior Product Manager, DevGovOps Roy Goldenberg, JFrog Product Marketing Manager, AppTrust | 6 min read

Picture two realities for the same compliance control reaching production. Reality One: Your AppSec team writes a new rule. An engineer uses Claude Code or Cursor to generate the OPA (Open Policy Agent) Rego policy in minutes. They deploy it. It blocks a legitimate release on a missing context variable, and the on-call engineer routes…
Read More
The Governance Gap: What IDC’s 2026 Data Reveals About AI and the Software Supply Chain

The Governance Gap: What IDC’s 2026 Data Reveals About AI and the Software Supply Chain

June 10, 2026 Yuval Fernbach and Asaf Barkan | 4 min read

In a landscape where executive teams demand immediate AI integration, engineering and security leaders find themselves navigating a complex operational balancing act. To explore how organizations can accelerate delivery pipelines without introducing fatal security risks, JFrog recently hosted a virtual panel discussion titled "Agentic Software Delivery in 2026: How to Bridge the Gap Between AI…
Read More

Popular Tags