Block Malicious Packages Before They Enter Your Software Supply Chain

SCA tools were built for a different threat. They catch known vulnerabilities by matching components against CVE databases, but supply chain attackers inject malicious code into legitimate packages that have no CVE and no vulnerability history. To an SCA tool, intentionally malicious code looks clean because it isn’t on any list. Effective supply chain security requires governing components before they enter your environment, not scanning after they’re already inside. JFrog Curation identifies malicious packages faster than public databases are updated and holds newly published package versions for 14 days to close the window attackers exploit.

Both frameworks require organizations to verify the security of open source components before integration, not after. Executive Order 14028 mandates secure software development practices including the generation of a Software Bill of Materials (SBOM) to provide full visibility into components used. The EU Cyber Resilience Act requires malicious software prevention and due diligence on third-party components before integration, alongside ongoing vulnerability management across the product lifecycle. JFrog Curation enforces automated policy verification at the moment a developer requests a component and generates an immutable audit trail of every request, block, and approval. This provides the documented evidence both frameworks require.

Applying comprehensive open-source AI model governance, JFrog Curation extends the same automated policy enforcement to AI models from Hugging Face and NVIDIA NIM as it does to standard packages. It evaluates every model against your security and compliance policies before it enters your environment. With coverage across 97.1% of Hugging Face models, organizations can adopt AI without compromising their supply chain integrity.

Jfrog Curation intercepts and evaluates every component the moment they are requested, before being downloaded. Curation does this automatically, enforcing your security, compliance, and operational policies at the entry point of your supply chain and delivering a safe, compliant alternative where one exists. For unknown threats, the immaturity policy holds new package versions for 145 days, buying time until a poisoned package is publicly flagged.

JFrog’s dedicated security research team identifies and flags malicious packages faster than public databases are updated, protecting your organization before the wider community is aware of the threat. The JFrog Catalog continuously analyzes package metadata, behavior, and provenance across 15 million+ components making manual tracking unnecessary. For threats not yet discovered, the immaturity policy provides a structural defense by blocking new package versions for 14 days, closing the window before attackers can exploit them.

When JFrog Curation blocks a component, your build doesn’t break. Where a safe, compliant version exists, Curation automatically delivers it. If no compliant version is available,you can request a waiver directly from your workflow without raising a security ticket. Every waiver request is logged automatically, so the security team has full visibility without becoming a bottleneck.