Welcome to the JFrog Blog

Latest:

From Silos to Synergy: Unifying Your Security Tools for a Stronger More Resilient Software Supply Chain

October 1, 2025 Paul Davis, Field CISO

4 min read

In the race to secure today’s ever-expanding attack surface, many companies have made a  practice of using a mix of tools to monitor, assess, and remediate threats. This practice has resulted in a fragmented and chaotic landscape of security solutions across several teams, increasing complexity and forcing companies to have a reactive vs. proactive security…

Read More

All Blogs

JFrog and ServiceNow: Accelerate Trusted Software Application Development

JFrog and ServiceNow: Accelerate Trusted Software Application Development

September 30, 2025 Brian Chang, Product Marketing Manager | 4 min read

Today’s software organizations can't make tradeoffs between speed and trust – you need both to succeed. But juggling them is tough. Moving too fast can lead to security vulnerabilities and compliance issues, while moving too slow means your competitors beat you to market. This tension creates friction that slows down every release, a problem that…
Read More
swampUP 2025 Recap: The Quantum Shift in Software Delivery Requires a Unified Approach

swampUP 2025 Recap: The Quantum Shift in Software Delivery Requires a Unified Approach

September 17, 2025 The JFrog Team | 13 min read

And that’s a wrap! Held in beautiful Napa Valley, swampUP 2025, JFrog’s annual customer conference brought together developers, operations, security, compliance, and AI/ML leaders – all facing the same burning challenges posed by the AI-driven quantum shift in software delivery. In the keynotes, breakout sessions, and side-conversations over wine and coffee, a common theme was…
Read More
Key Takeaways from Frogward Innovation Days in India

Key Takeaways from Frogward Innovation Days in India

September 18, 2025 Prasanna Raghavendra, JFrog Senior Director of R&D | 7 min read

At JFrog India, we recently wrapped up Frogward Innovation Days—a week-long celebration in Bangalore where internal teams from engineering, IT, marketing, sales ops, and support came together to collaborate, experiment, and solve real-world challenges. Before diving into the highlights, it’s worth sharing what makes Frogward Innovation Days unique. This isn’t just a week of fun…
Read More
Shifting Security ‘Lefter’ Than Left Is The Key To Avoiding Risky Packages

Shifting Security ‘Lefter’ Than Left Is The Key To Avoiding Risky Packages

September 19, 2025 Asaf Karas, JFrog CTO & SVP Security | 4 min read

As the AI revolution accelerates, developers are being inundated with a dazzling array of new software packages and game-changing tools such as GitHub CoPilot, Sourcegraph, Qodo, Cursor, Goose, and others that promise incredible advances in productivity and impact. The excitement over this is high and just keeps on growing. Cyberattackers share equally in this excitement;…
Read More
Shai-Hulud npm supply chain attack – new compromised packages detected

Shai-Hulud npm supply chain attack – new compromised packages detected

September 16, 2025 Andrey Polkovnichenko, JFrog Security Researcher | 7 min read

Recently, the npm ecosystem has faced its third large-scale attack. Following the recent compromise of the nx packages  and another wave targeting popular packages, the registry has once again been attacked. The first report came from Daniel Pereira, who identified a compromised package: @ctrl/tinycolor@4.1.1. By the end of the day, JFrog’s malware scanners had identified…
Read More
Chaotic Deputy: Critical vulnerabilities in Chaos Mesh lead to Kubernetes cluster takeover

Chaotic Deputy: Critical vulnerabilities in Chaos Mesh lead to Kubernetes cluster takeover

September 16, 2025 Natan Nehorai, JFrog Application Security Researcher | 11 min read

JFrog Security Research recently discovered and disclosed multiple CVEs in the highly popular Chaos engineering platform - Chaos-Mesh. The discovered CVEs, which we’ve named Chaotic Deputy are CVE-2025-59358, CVE-2025-59360, CVE-2025-59361 and CVE-2025-59359. The last three Chaotic Deputy CVEs are critical severity (CVSS 9.8) vulnerabilities which can be easily exploited by in-cluster attackers to run arbitrary…
Read More
New compromised packages identified in largest npm attack in history

New compromised packages identified in largest npm attack in history

September 9, 2025 Andrey Polkovnichenko, JFrog Security Researcher | 3 min read

Duckdb, coveops/abi and more new packages discovered as compromised in the ongoing phishing campaign On September 8th, a malicious actor compromised the npm registry by publishing trojanized versions of 18 widely-used packages, after obtaining developers’ tokens in a phishing attack, as reported by Aikido. Massively popular packages such as "debug", "chalk" and "ansi-styles" were compromised.…
Read More
The AI/ML Regulatory Landscape and How to Stay Ahead

The AI/ML Regulatory Landscape and How to Stay Ahead

September 11, 2025 Paul Davis, Field CISO | 5 min read

The entire world of technology is abuzz about AI/ML. It’s arguably the most disruptive technology to society since the smartphone. In fact, Gartner estimates that the number of companies using open-source AI directly will increase tenfold by 2027. While this rapid advance is fueling quantum leaps in innovation, it also ignites increasing scrutiny from regulatory…
Read More
JFrog swampUP 2025: News and Updates Live From the Show Floor

JFrog swampUP 2025: News and Updates Live From the Show Floor

September 9, 2025 The JFrog Team | 33 min read

Live updates from this event have concluded. JFrog’s annual user conference, swampUP 2025, is the ultimate gathering of the brightest minds in DevOps, DevSecOps, and MLOps where they exchange ideas, insights and practical strategies for navigating this transformation while amplifying trust, traceability, and transparency in the era of intelligent software. Here are live keynote updates…
Read More
JFrog and GitHub: Next-Level DevSecOps

JFrog and GitHub: Next-Level DevSecOps

September 10, 2025 Paul Garden, JFrog Partner and Industry Solutions | 6 min read

Most DevSecOps pipelines have a gap: source code security and binary security are handled in separate silos. This creates blind spots, slows teams down, and increases risk. At swampUP 2025, we’re unveiling the next evolution of the JFrog and GitHub integration, a deeply integrated DevSecOps experience that unifies best-of-breed code and binary platforms. With JFrog…
Read More

Popular Tags