Welcome to the JFrog Blog

Latest from Old Security :

npm v12’s Biggest Security Change: From Implicit to Explicit Trust

June 18, 2026 Ofri Ouzan, JFrog Security Researcher Guy Korolevski, JFrog Security Researcher

14 min read

For years, installing an npm package has meant trusting that every package in the dependency tree will behave as expected. Whether code originated from the npm registry, a Git repository, a remote URL, or an installation script buried deep within a transitive dependency, npm would typically execute or retrieve it automatically during the installation process.…

Read More
JFrog’s Best DevSecOps Blogs of 2021

JFrog’s Best DevSecOps Blogs of 2021

January 13, 2022 JFrog Team | 7 min read

Always a concern for DevOps teams, security has now become a critical part of developing and releasing software – a reality reflected on the sharp increase in JFrog blogs about DevSecOps. In fact, we generated so many hard-hitting and instructive blogs about security and compliance in 2021 that we decided our DevSecOps coverage deserved its…
Read More
Major Vulnerabilities Discovered in Qualcomm QCMAP

Major Vulnerabilities Discovered in Qualcomm QCMAP

October 14, 2020 Ori Hollander and Asaf Karas | 14 min read

In a recent supply chain security assessment, we analyzed multiple networking devices for security vulnerabilities and exposures. During the analysis we discovered and have responsibly disclosed four major vulnerabilities in Qualcomm’s QCMAP (Qualcomm Mobile Access Point) architecture that these devices were based on. An attacker that exploits the discovered vulnerabilities can gain remote root access…
Read More
Air Gap Distribution Delivers Peace of Mind to Isolated Environments

Air Gap Distribution Delivers Peace of Mind to Isolated Environments

October 13, 2020 Randy Kau | 4 min read

The best way to stay out of danger is to keep far away from where danger lurks. But in the internet age, the global network means risk to your systems is from everywhere, at all times.  With estimates that worldwide damage from cybercrime will exceed 6 trillion dollars by 2021, many companies choose, or are…
Read More
GoCenter Reveals Go Module Vulnerabilities With Xray

GoCenter Reveals Go Module Vulnerabilities With Xray

April 30, 2021 Deep Datta | 4 min read

  UPDATE: As of May 1, 2021 - GoCenter central repository has been sunset and all features deprecated. For more information on the sunsetting of the centers read the deprecation blog post   Golang developers care a lot about security and as Go modules become more widely used, they need more ways to assure these…
Read More
4 Ways Xray and Artifactory Complete DevSecOps

4 Ways Xray and Artifactory Complete DevSecOps

July 30, 2019 Paul Garden | 5 min read

Being universal is a huge part of what makes JFrog Artifactory so effective. Whether you use Jenkins, CircleCI, or Bitbucket to automate your CI/CD pipeline, Artifactory works with those and more. Whether you prefer to store your artifacts in an on-premises filestore or in the cloud, Artifactory will manage them. Which cloud? Artifactory is content…
Read More
Shift Your IDE Left With Xray Plugins

Shift Your IDE Left With Xray Plugins

May 28, 2019 Yahav Itzhak and Alexei Vainshtein | 5 min read

"Forewarned is forearmed,” cautions the old proverb, and that truth coined in the 16th century is even more apt for DevSecOps in the 21st. The earlier you know about vulnerabilities, the better you can avoid making them part of your software. That’s the same principle behind a “Shift Left” DevSecOps strategy. Rather than waiting for…
Read More
You have Docker; Now are your Docker images secure?

You have Docker; Now are your Docker images secure?

August 8, 2018 Ibrahim Rahmani | 7 min read

This is the second blog in our series on Docker. In our initial blog called You have Docker; Now what?, we discussed the reasons for using a universal binary repository when implementing Docker to production with confidence. It’s great that you're using Docker, but managing security vulnerabilities is vital to ensuring your Docker environment is free…
Read More
Twistlock and JFrog Steer the Container DevSecOps Seas

Twistlock and JFrog Steer the Container DevSecOps Seas

July 16, 2018 Craig Peters | 4 min read

Twistlock and JFrog have partnered to provide continuous scanning and security for your builds. Twistlock directly integrates with JFrog Artifactory, which provides a fully automated Docker promotion pipeline for maintaining your Docker registries. What is Twistlock? Twistlock is a versatile security solution that works well with the Kubernetes container orchestrator and integrates smoothly with JFrog…
Read More
Securely Onboarding Colleagues through SAML Authentication

Securely Onboarding Colleagues through SAML Authentication

April 30, 2021 Gali Surkis | 2 min read

UPDATE: As of May 1, 2021 Bintray services will no longer be available (ConanCenter and JCenter are not affected) for more information read the Centers Deprecation Blog Once you’ve created your Bintray account, getting your colleagues on board with permission-based access to your organization’s content is not always so easy. You want to use the…
Read More

Popular Tags