{"id":162297,"date":"2025-09-19T22:01:37","date_gmt":"2025-09-19T20:01:37","guid":{"rendered":"https:\/\/jfrog.com\/blog\/shifting-security-lefter-than-left-is-the-key-to-avoiding-risky-packages\/"},"modified":"2026-01-21T15:07:01","modified_gmt":"2026-01-21T13:07:01","slug":"shifting-security-lefter-than-left-is-the-key-to-avoiding-risky-packages","status":"publish","type":"post","link":"https:\/\/jfrog.com\/fr\/blog\/shifting-security-lefter-than-left-is-the-key-to-avoiding-risky-packages\/","title":{"rendered":"S\u00e9curit\u00e9 : passer \u00e0 l\u2019ultra-shift left pour bannir les packages compromis"},"content":{"rendered":"

\"\"<\/p>\n

Alors que la r\u00e9volution de l\u2019IA s\u2019acc\u00e9l\u00e8re, les d\u00e9veloppeurs sont inond\u00e9s d\u2019une gamme \u00e9blouissante de nouveaux progiciels et d\u2019outils r\u00e9volutionnaires, tels que GitHub CoPilot, Sourcegraph, Qodo, Cursor, Goose et d\u2019autres qui promettent des progr\u00e8s incroyables en termes de productivit\u00e9 et d\u2019impact. L\u2019enthousiasme \u00e0 ce sujet est \u00e9lev\u00e9 et ne cesse de cro\u00eetre.<\/p>\n

Les cyberattaquants partagent pleinement cet engouement : l\u2019adoption de nouveaux outils de d\u00e9veloppement progresse toujours plus vite que leur s\u00e9curisation, offrant ainsi aux acteurs malveillants une fen\u00eatre d\u2019opportunit\u00e9 pour exploiter des vuln\u00e9rabilit\u00e9s avec peu, voire aucun obstacle en mati\u00e8re de contr\u00f4les de s\u00e9curit\u00e9 rigoureux.<\/p>\n

Le monde de la s\u00e9curit\u00e9 des d\u00e9veloppeurs a bien progress\u00e9 dans la s\u00e9curisation de l\u2019utilisation des d\u00e9pendances des logiciels open source (OSS) et des composants externes. Apr\u00e8s tout, la grande majorit\u00e9 des vuln\u00e9rabilit\u00e9s dans les bases de code des applications sont introduites par des blocs de construction tiers. Mais \u00e0 mesure que nous progressons dans l\u2019\u00e8re de l\u2019IA, les risques de s\u00e9curit\u00e9 de la cha\u00eene d\u2019approvisionnement logicielle augmentent rapidement et s\u2019\u00e9tendent \u00e9galement au-del\u00e0 des d\u00e9pendances logicielles aux outils et extensions des d\u00e9veloppeurs.<\/p>\n

La plus grande attaque de la cha\u00eene d\u2019approvisionnement npm de l\u2019histoire touche 20\u00a0packages<\/h2>\n

Une attaque de la cha\u00eene d\u2019approvisionnement logicielle exploitant des packages logiciels npm populaires a \u00e9t\u00e9 d\u00e9couverte le 8\u00a0septembre\u00a02025.<\/a> 20\u00a0packages, repr\u00e9sentant plus de 2\u00a0milliards de t\u00e9l\u00e9chargements, ont \u00e9t\u00e9 compromis. Dans ce cas, l\u2019attaquant a inject\u00e9 un code malveillant con\u00e7u pour intercepter et rediriger les transactions de cryptomonnaie. La port\u00e9e de cette attaque en fait l\u2019attaque de la cha\u00eene d\u2019approvisionnement la plus r\u00e9pandue de l\u2019histoire de npm. (Consultez le blog<\/a> de l\u2019\u00e9quipe de recherche en s\u00e9curit\u00e9 de JFrog pour une analyse technique plus d\u00e9taill\u00e9e de cet incident). Heureusement, l\u2019impact a \u00e9t\u00e9 minime, malgr\u00e9 les 2,5\u00a0millions de t\u00e9l\u00e9chargements de ces packages compromis.<\/p>\n

Ces types d\u2019attaques ne feront que gagner en fr\u00e9quence et en sophistication, et de nombreuses organisations productrices de logiciels continueront de se retrouver prises en \u00e9tau entre, d\u2019un c\u00f4t\u00e9, des mesures de s\u00e9curit\u00e9 draconiennes qui brident la v\u00e9locit\u00e9 et la productivit\u00e9 des d\u00e9veloppeurs et, de l\u2019autre, une prise de risque excessive sur la s\u00e9curit\u00e9 de la cha\u00eene d\u2019approvisionnement logicielle li\u00e9e \u00e0 l\u2019utilisation d\u2019artefacts, de packages et d\u2019outils non \u00e9valu\u00e9s.<\/p>\n

S\u2019appuyer sur les d\u00e9veloppeurs pour v\u00e9rifier manuellement chaque package ou outil n\u2019est tout simplement pas une strat\u00e9gie viable. Ce qu\u2019il faut, c\u2019est un moyen de bloquer les composants \u00e0 risque ou malveillants d\u00e8s le d\u00e9part, en veillant \u00e0 ce qu\u2019ils n\u2019entrent jamais dans le cycle de vie du d\u00e9veloppement logiciel.<\/p>\n

C\u2019est l\u2019approche diff\u00e9renci\u00e9e que JFrog adopte avec sa plateforme de s\u00e9curit\u00e9 de la cha\u00eene d\u2019approvisionnement logicielle\u00a0: nous faisons passer la s\u00e9curit\u00e9 \u00e0 l\u2019ultra-shift left.<\/p>\n

Pr\u00e9venir les risques avec JFrog Curation<\/h2>\n

JFrog Curation<\/a> est la solution qui permet aux d\u00e9veloppeurs de travailler sans effort avec des d\u00e9pendances et des packages valid\u00e9s et approuv\u00e9s. Elle agit essentiellement comme un pare-feu entre vos d\u00e9veloppeurs et les d\u00e9p\u00f4ts publics, en veillant \u00e0 ce que seuls les d\u00e9pendances et les packages OSS approuv\u00e9s soient autoris\u00e9s dans l\u2019\u00e9cosyst\u00e8me de votre organisation.<\/p>\n

JFrog Curation assure le suivi des packages OSS et des mod\u00e8les approuv\u00e9s par votre organisation et propose une approche, pilot\u00e9e par des politiques, de l\u2019utilisation des composants logiciels tiers, cr\u00e9ant ainsi une situation gagnant-gagnant pour les \u00e9quipes de s\u00e9curit\u00e9 et les d\u00e9veloppeurs.<\/p>\n

\"FIGURE<\/p>\n

FIGURE 1 : Cr\u00e9ation de politiques d\u00e9taill\u00e9es bloquant l\u2019utilisation de packages immatures dans Curation
\n<\/em><\/p>\n

JFrog Curation permet de consid\u00e9rablement renforcer le niveau de s\u00e9curit\u00e9. Imaginez le sc\u00e9nario courant o\u00f9 une nouvelle version de package est publi\u00e9e et o\u00f9 les d\u00e9veloppeurs se pr\u00e9cipitent pour la t\u00e9l\u00e9charger et l\u2019utiliser. Les packages immatures peuvent comporter des risques op\u00e9rationnels et \u00e9galement de graves risques de s\u00e9curit\u00e9, qui sont g\u00e9n\u00e9ralement d\u00e9couverts dans un d\u00e9lai de 14\u00a0jours \u00e0 compter de la date de publication. Avec Curation, les \u00e9quipes de s\u00e9curit\u00e9 peuvent cr\u00e9er et appliquer des politiques qui bloquent tout nouveau package en fonction de son anciennet\u00e9, ce qui donne le temps n\u00e9cessaire \u00e0 une v\u00e9rification appropri\u00e9e par la communaut\u00e9 s\u00e9curit\u00e9 dans son ensemble.<\/p>\n

On pourrait penser que l\u2019application d\u2019une telle politique d\u00e9graderait l\u2019exp\u00e9rience du d\u00e9veloppeur. Apr\u00e8s tout, se voir bloquer l\u2019utilisation d\u2019un package peut totalement mettre \u00e0 l\u2019arr\u00eat le projet d\u2019un d\u00e9veloppeur logiciel. Curation permet \u00e9galement de maintenir l\u2019exp\u00e9rience du d\u00e9veloppeur. Si les derniers packages demand\u00e9s par les d\u00e9veloppeurs ne r\u00e9pondent pas \u00e0 l\u2019exigence de la politique de maturit\u00e9, Curation demandera simplement \u00e0 Artifactory de fournir la derni\u00e8re version conforme, conform\u00e9ment \u00e0 vos politiques d\u00e9finies.<\/p>\n

Vous voulez avoir un aper\u00e7u d\u00e9taill\u00e9 de la fa\u00e7on dont Curation d\u00e9fend votre cha\u00eene d\u2019approvisionnement logicielle contre les packages \u00e0 risque\u00a0? Planifiez une r\u00e9union avec l\u2019un de nos experts\u00a0!<\/a><\/strong><\/p>\n","protected":false},"excerpt":{"rendered":"

Alors que la r\u00e9volution de l\u2019IA s\u2019acc\u00e9l\u00e8re, les d\u00e9veloppeurs sont inond\u00e9s d\u2019une gamme \u00e9blouissante de nouveaux progiciels et d\u2019outils r\u00e9volutionnaires, tels que GitHub CoPilot, Sourcegraph, Qodo, Cursor, Goose et d\u2019autres qui promettent des progr\u00e8s incroyables en termes de productivit\u00e9 et d\u2019impact. L\u2019enthousiasme \u00e0 ce sujet est \u00e9lev\u00e9 et ne cesse de cro\u00eetre. Les cyberattaquants partagent …<\/p>\n","protected":false},"author":648,"featured_media":158398,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"inline_featured_image":false,"footnotes":""},"categories":[10153],"tags":[9999],"class_list":["post-162297","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-securite-et-devsecops","tag-securite-recherche","resource_categories-security-research"],"yoast_head":"\nS\u00e9curit\u00e9 : passer \u00e0 l\u2019ultra-shift left pour bannir les packages compromis<\/title>\n<meta name=\"description\" content=\"S\u00e9curisez votre supply chain logicielle avec JFrog Curation : bloquez les packages risqu\u00e9s \u00e0 la source et allez au-del\u00e0 du Shift Left traditionnel.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/jfrog.com\/fr\/wp-json\/wp\/v2\/posts\/162297\" \/>\n<meta property=\"og:locale\" content=\"fr_FR\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"S\u00e9curit\u00e9 : passer \u00e0 l\u2019ultra-shift left pour bannir les packages compromis\" \/>\n<meta property=\"og:description\" content=\"S\u00e9curisez votre supply chain logicielle avec JFrog Curation : bloquez les packages risqu\u00e9s \u00e0 la source et allez au-del\u00e0 du Shift Left traditionnel.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/jfrog.com\/fr\/blog\/shifting-security-lefter-than-left-is-the-key-to-avoiding-risky-packages\/\" \/>\n<meta property=\"og:site_name\" content=\"JFrog\" \/>\n<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/artifrog\" \/>\n<meta property=\"article:published_time\" content=\"2025-09-19T20:01:37+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2026-01-21T13:07:01+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/media.jfrog.com\/wp-content\/uploads\/2025\/09\/19220051\/NPM-pkg_blog_1200x628.png\" \/>\n\t<meta property=\"og:image:width\" content=\"1200\" \/>\n\t<meta property=\"og:image:height\" content=\"628\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/png\" \/>\n<meta name=\"author\" content=\"jennifermc\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:creator\" content=\"@jfrog\" \/>\n<meta name=\"twitter:site\" content=\"@jfrog\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"jennifermc\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"4 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\/\/jfrog.com\/fr\/blog\/shifting-security-lefter-than-left-is-the-key-to-avoiding-risky-packages\/#article\",\"isPartOf\":{\"@id\":\"https:\/\/jfrog.com\/fr\/blog\/shifting-security-lefter-than-left-is-the-key-to-avoiding-risky-packages\/\"},\"author\":{\"name\":\"jennifermc\",\"@id\":\"https:\/\/jfrog.com\/fr\/#\/schema\/person\/8d56766031e8bae97b53416767c6b54f\"},\"headline\":\"S\u00e9curit\u00e9 : passer \u00e0 l\u2019ultra-shift left pour bannir les packages compromis\",\"datePublished\":\"2025-09-19T20:01:37+00:00\",\"dateModified\":\"2026-01-21T13:07:01+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\/\/jfrog.com\/fr\/blog\/shifting-security-lefter-than-left-is-the-key-to-avoiding-risky-packages\/\"},\"wordCount\":926,\"publisher\":{\"@id\":\"https:\/\/jfrog.com\/fr\/#organization\"},\"image\":{\"@id\":\"https:\/\/jfrog.com\/fr\/blog\/shifting-security-lefter-than-left-is-the-key-to-avoiding-risky-packages\/#primaryimage\"},\"thumbnailUrl\":\"https:\/\/speedmedia2.jfrog.com\/08612fe1-9391-4cf3-ac1a-6dd49c36b276\/media.jfrog.com\/wp-content\/uploads\/2025\/09\/19215858\/NPM-pkg_blog_thumbnail.png\",\"keywords\":[\"securite-recherche\"],\"articleSection\":[\"S\u00e9curit\u00e9 et DevSecOps\"],\"inLanguage\":\"fr-FR\"},{\"@type\":\"WebPage\",\"@id\":\"https:\/\/jfrog.com\/fr\/blog\/shifting-security-lefter-than-left-is-the-key-to-avoiding-risky-packages\/\",\"url\":\"https:\/\/jfrog.com\/fr\/blog\/shifting-security-lefter-than-left-is-the-key-to-avoiding-risky-packages\/\",\"name\":\"S\u00e9curit\u00e9 : passer \u00e0 l\u2019ultra-shift left pour bannir les packages compromis\",\"isPartOf\":{\"@id\":\"https:\/\/jfrog.com\/fr\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\/\/jfrog.com\/fr\/blog\/shifting-security-lefter-than-left-is-the-key-to-avoiding-risky-packages\/#primaryimage\"},\"image\":{\"@id\":\"https:\/\/jfrog.com\/fr\/blog\/shifting-security-lefter-than-left-is-the-key-to-avoiding-risky-packages\/#primaryimage\"},\"thumbnailUrl\":\"https:\/\/speedmedia2.jfrog.com\/08612fe1-9391-4cf3-ac1a-6dd49c36b276\/media.jfrog.com\/wp-content\/uploads\/2025\/09\/19215858\/NPM-pkg_blog_thumbnail.png\",\"datePublished\":\"2025-09-19T20:01:37+00:00\",\"dateModified\":\"2026-01-21T13:07:01+00:00\",\"description\":\"S\u00e9curisez votre supply chain logicielle avec JFrog Curation : bloquez les packages risqu\u00e9s \u00e0 la source et allez au-del\u00e0 du Shift Left traditionnel.\",\"breadcrumb\":{\"@id\":\"https:\/\/jfrog.com\/fr\/blog\/shifting-security-lefter-than-left-is-the-key-to-avoiding-risky-packages\/#breadcrumb\"},\"inLanguage\":\"fr-FR\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/jfrog.com\/fr\/blog\/shifting-security-lefter-than-left-is-the-key-to-avoiding-risky-packages\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"fr-FR\",\"@id\":\"https:\/\/jfrog.com\/fr\/blog\/shifting-security-lefter-than-left-is-the-key-to-avoiding-risky-packages\/#primaryimage\",\"url\":\"https:\/\/speedmedia2.jfrog.com\/08612fe1-9391-4cf3-ac1a-6dd49c36b276\/media.jfrog.com\/wp-content\/uploads\/2025\/09\/19215858\/NPM-pkg_blog_thumbnail.png\",\"contentUrl\":\"https:\/\/speedmedia2.jfrog.com\/08612fe1-9391-4cf3-ac1a-6dd49c36b276\/media.jfrog.com\/wp-content\/uploads\/2025\/09\/19215858\/NPM-pkg_blog_thumbnail.png\",\"width\":203,\"height\":148},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/jfrog.com\/fr\/blog\/shifting-security-lefter-than-left-is-the-key-to-avoiding-risky-packages\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\/\/jfrog.com\/fr\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"S\u00e9curit\u00e9 : passer \u00e0 l\u2019ultra-shift left pour bannir les packages compromis\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/jfrog.com\/fr\/#website\",\"url\":\"https:\/\/jfrog.com\/fr\/\",\"name\":\"JFrog\",\"description\":\"Deliver Trusted Software Releases at Speed and Scale\",\"publisher\":{\"@id\":\"https:\/\/jfrog.com\/fr\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/jfrog.com\/fr\/?s={search_term_string}\"},\"query-input\":\"required name=search_term_string\"}],\"inLanguage\":\"fr-FR\"},{\"@type\":\"Organization\",\"@id\":\"https:\/\/jfrog.com\/fr\/#organization\",\"name\":\"JFrog\",\"url\":\"https:\/\/jfrog.com\/fr\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"fr-FR\",\"@id\":\"https:\/\/jfrog.com\/fr\/#\/schema\/logo\/image\/\",\"url\":\"https:\/\/speedmedia2.jfrog.com\/08612fe1-9391-4cf3-ac1a-6dd49c36b276\/media.jfrog.com\/wp-content\/uploads\/2025\/05\/27095207\/Logo.svg\",\"contentUrl\":\"https:\/\/speedmedia2.jfrog.com\/08612fe1-9391-4cf3-ac1a-6dd49c36b276\/media.jfrog.com\/wp-content\/uploads\/2025\/05\/27095207\/Logo.svg\",\"width\":74,\"height\":73,\"caption\":\"JFrog\"},\"image\":{\"@id\":\"https:\/\/jfrog.com\/fr\/#\/schema\/logo\/image\/\"},\"sameAs\":[\"https:\/\/www.facebook.com\/artifrog\",\"https:\/\/x.com\/jfrog\",\"https:\/\/www.linkedin.com\/company\/455737\",\"https:\/\/www.youtube.com\/channel\/UCh2hNg76zo3d1qQqTWIQxDg\",\"https:\/\/www.wikidata.org\/wiki\/Q98608948\"],\"description\":\"We set out on our Liquid Software journey in 2008, with the mission to transform the way enterprises manage and release software updates. The world expects software to update continuously, securely, non-intrusively and without user intervention. This hyper-connected experience can only be enabled by automation with an end-to-end DevOps platform and a binary-centric focus. With this in mind, we\u2019ve developed the JFrog Platform, ushering in a new era of DevOps and DevSecOps standards that power continuous updates. More than a decade after our founding, with thousands of customers and millions of users globally, JFrog has become the \u201cDatabase of DevOps\u201d and the de-facto standard in release and update management.\",\"legalName\":\"Jfrog, Inc.\",\"numberOfEmployees\":{\"@type\":\"QuantitativeValue\",\"minValue\":\"1001\",\"maxValue\":\"5000\"}},{\"@type\":\"Person\",\"@id\":\"https:\/\/jfrog.com\/fr\/#\/schema\/person\/8d56766031e8bae97b53416767c6b54f\",\"name\":\"jennifermc\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"fr-FR\",\"@id\":\"https:\/\/jfrog.com\/fr\/#\/schema\/person\/image\/\",\"url\":\"https:\/\/secure.gravatar.com\/avatar\/5e56c6d2fb8b7553202991694700b600df03884ae366bf115dc962790c07576a?s=96&d=mm&r=g\",\"contentUrl\":\"https:\/\/secure.gravatar.com\/avatar\/5e56c6d2fb8b7553202991694700b600df03884ae366bf115dc962790c07576a?s=96&d=mm&r=g\",\"caption\":\"jennifermc\"}}]}<\/script>\n<!-- \/ Yoast SEO Premium plugin. -->","yoast_head_json":{"title":"S\u00e9curit\u00e9 : passer \u00e0 l\u2019ultra-shift left pour bannir les packages compromis","description":"S\u00e9curisez votre supply chain logicielle avec JFrog Curation : bloquez les packages risqu\u00e9s \u00e0 la source et allez au-del\u00e0 du Shift Left traditionnel.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/jfrog.com\/fr\/wp-json\/wp\/v2\/posts\/162297","og_locale":"fr_FR","og_type":"article","og_title":"S\u00e9curit\u00e9 : passer \u00e0 l\u2019ultra-shift left pour bannir les packages compromis","og_description":"S\u00e9curisez votre supply chain logicielle avec JFrog Curation : bloquez les packages risqu\u00e9s \u00e0 la source et allez au-del\u00e0 du Shift Left traditionnel.","og_url":"https:\/\/jfrog.com\/fr\/blog\/shifting-security-lefter-than-left-is-the-key-to-avoiding-risky-packages\/","og_site_name":"JFrog","article_publisher":"https:\/\/www.facebook.com\/artifrog","article_published_time":"2025-09-19T20:01:37+00:00","article_modified_time":"2026-01-21T13:07:01+00:00","og_image":[{"width":1200,"height":628,"url":"https:\/\/media.jfrog.com\/wp-content\/uploads\/2025\/09\/19220051\/NPM-pkg_blog_1200x628.png","type":"image\/png"}],"author":"jennifermc","twitter_card":"summary_large_image","twitter_creator":"@jfrog","twitter_site":"@jfrog","twitter_misc":{"Written by":"jennifermc","Est. reading time":"4 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/jfrog.com\/fr\/blog\/shifting-security-lefter-than-left-is-the-key-to-avoiding-risky-packages\/#article","isPartOf":{"@id":"https:\/\/jfrog.com\/fr\/blog\/shifting-security-lefter-than-left-is-the-key-to-avoiding-risky-packages\/"},"author":{"name":"jennifermc","@id":"https:\/\/jfrog.com\/fr\/#\/schema\/person\/8d56766031e8bae97b53416767c6b54f"},"headline":"S\u00e9curit\u00e9 : passer \u00e0 l\u2019ultra-shift left pour bannir les packages compromis","datePublished":"2025-09-19T20:01:37+00:00","dateModified":"2026-01-21T13:07:01+00:00","mainEntityOfPage":{"@id":"https:\/\/jfrog.com\/fr\/blog\/shifting-security-lefter-than-left-is-the-key-to-avoiding-risky-packages\/"},"wordCount":926,"publisher":{"@id":"https:\/\/jfrog.com\/fr\/#organization"},"image":{"@id":"https:\/\/jfrog.com\/fr\/blog\/shifting-security-lefter-than-left-is-the-key-to-avoiding-risky-packages\/#primaryimage"},"thumbnailUrl":"https:\/\/speedmedia2.jfrog.com\/08612fe1-9391-4cf3-ac1a-6dd49c36b276\/media.jfrog.com\/wp-content\/uploads\/2025\/09\/19215858\/NPM-pkg_blog_thumbnail.png","keywords":["securite-recherche"],"articleSection":["S\u00e9curit\u00e9 et DevSecOps"],"inLanguage":"fr-FR"},{"@type":"WebPage","@id":"https:\/\/jfrog.com\/fr\/blog\/shifting-security-lefter-than-left-is-the-key-to-avoiding-risky-packages\/","url":"https:\/\/jfrog.com\/fr\/blog\/shifting-security-lefter-than-left-is-the-key-to-avoiding-risky-packages\/","name":"S\u00e9curit\u00e9 : passer \u00e0 l\u2019ultra-shift left pour bannir les packages compromis","isPartOf":{"@id":"https:\/\/jfrog.com\/fr\/#website"},"primaryImageOfPage":{"@id":"https:\/\/jfrog.com\/fr\/blog\/shifting-security-lefter-than-left-is-the-key-to-avoiding-risky-packages\/#primaryimage"},"image":{"@id":"https:\/\/jfrog.com\/fr\/blog\/shifting-security-lefter-than-left-is-the-key-to-avoiding-risky-packages\/#primaryimage"},"thumbnailUrl":"https:\/\/speedmedia2.jfrog.com\/08612fe1-9391-4cf3-ac1a-6dd49c36b276\/media.jfrog.com\/wp-content\/uploads\/2025\/09\/19215858\/NPM-pkg_blog_thumbnail.png","datePublished":"2025-09-19T20:01:37+00:00","dateModified":"2026-01-21T13:07:01+00:00","description":"S\u00e9curisez votre supply chain logicielle avec JFrog Curation : bloquez les packages risqu\u00e9s \u00e0 la source et allez au-del\u00e0 du Shift Left traditionnel.","breadcrumb":{"@id":"https:\/\/jfrog.com\/fr\/blog\/shifting-security-lefter-than-left-is-the-key-to-avoiding-risky-packages\/#breadcrumb"},"inLanguage":"fr-FR","potentialAction":[{"@type":"ReadAction","target":["https:\/\/jfrog.com\/fr\/blog\/shifting-security-lefter-than-left-is-the-key-to-avoiding-risky-packages\/"]}]},{"@type":"ImageObject","inLanguage":"fr-FR","@id":"https:\/\/jfrog.com\/fr\/blog\/shifting-security-lefter-than-left-is-the-key-to-avoiding-risky-packages\/#primaryimage","url":"https:\/\/speedmedia2.jfrog.com\/08612fe1-9391-4cf3-ac1a-6dd49c36b276\/media.jfrog.com\/wp-content\/uploads\/2025\/09\/19215858\/NPM-pkg_blog_thumbnail.png","contentUrl":"https:\/\/speedmedia2.jfrog.com\/08612fe1-9391-4cf3-ac1a-6dd49c36b276\/media.jfrog.com\/wp-content\/uploads\/2025\/09\/19215858\/NPM-pkg_blog_thumbnail.png","width":203,"height":148},{"@type":"BreadcrumbList","@id":"https:\/\/jfrog.com\/fr\/blog\/shifting-security-lefter-than-left-is-the-key-to-avoiding-risky-packages\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/jfrog.com\/fr\/"},{"@type":"ListItem","position":2,"name":"S\u00e9curit\u00e9 : passer \u00e0 l\u2019ultra-shift left pour bannir les packages compromis"}]},{"@type":"WebSite","@id":"https:\/\/jfrog.com\/fr\/#website","url":"https:\/\/jfrog.com\/fr\/","name":"JFrog","description":"Deliver Trusted Software Releases at Speed and Scale","publisher":{"@id":"https:\/\/jfrog.com\/fr\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/jfrog.com\/fr\/?s={search_term_string}"},"query-input":"required name=search_term_string"}],"inLanguage":"fr-FR"},{"@type":"Organization","@id":"https:\/\/jfrog.com\/fr\/#organization","name":"JFrog","url":"https:\/\/jfrog.com\/fr\/","logo":{"@type":"ImageObject","inLanguage":"fr-FR","@id":"https:\/\/jfrog.com\/fr\/#\/schema\/logo\/image\/","url":"https:\/\/speedmedia2.jfrog.com\/08612fe1-9391-4cf3-ac1a-6dd49c36b276\/media.jfrog.com\/wp-content\/uploads\/2025\/05\/27095207\/Logo.svg","contentUrl":"https:\/\/speedmedia2.jfrog.com\/08612fe1-9391-4cf3-ac1a-6dd49c36b276\/media.jfrog.com\/wp-content\/uploads\/2025\/05\/27095207\/Logo.svg","width":74,"height":73,"caption":"JFrog"},"image":{"@id":"https:\/\/jfrog.com\/fr\/#\/schema\/logo\/image\/"},"sameAs":["https:\/\/www.facebook.com\/artifrog","https:\/\/x.com\/jfrog","https:\/\/www.linkedin.com\/company\/455737","https:\/\/www.youtube.com\/channel\/UCh2hNg76zo3d1qQqTWIQxDg","https:\/\/www.wikidata.org\/wiki\/Q98608948"],"description":"We set out on our Liquid Software journey in 2008, with the mission to transform the way enterprises manage and release software updates. The world expects software to update continuously, securely, non-intrusively and without user intervention. This hyper-connected experience can only be enabled by automation with an end-to-end DevOps platform and a binary-centric focus. With this in mind, we\u2019ve developed the JFrog Platform, ushering in a new era of DevOps and DevSecOps standards that power continuous updates. More than a decade after our founding, with thousands of customers and millions of users globally, JFrog has become the \u201cDatabase of DevOps\u201d and the de-facto standard in release and update management.","legalName":"Jfrog, Inc.","numberOfEmployees":{"@type":"QuantitativeValue","minValue":"1001","maxValue":"5000"}},{"@type":"Person","@id":"https:\/\/jfrog.com\/fr\/#\/schema\/person\/8d56766031e8bae97b53416767c6b54f","name":"jennifermc","image":{"@type":"ImageObject","inLanguage":"fr-FR","@id":"https:\/\/jfrog.com\/fr\/#\/schema\/person\/image\/","url":"https:\/\/secure.gravatar.com\/avatar\/5e56c6d2fb8b7553202991694700b600df03884ae366bf115dc962790c07576a?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/5e56c6d2fb8b7553202991694700b600df03884ae366bf115dc962790c07576a?s=96&d=mm&r=g","caption":"jennifermc"}}]}},"_links":{"self":[{"href":"https:\/\/jfrog.com\/fr\/wp-json\/wp\/v2\/posts\/162297","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/jfrog.com\/fr\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/jfrog.com\/fr\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/jfrog.com\/fr\/wp-json\/wp\/v2\/users\/648"}],"replies":[{"embeddable":true,"href":"https:\/\/jfrog.com\/fr\/wp-json\/wp\/v2\/comments?post=162297"}],"version-history":[{"count":3,"href":"https:\/\/jfrog.com\/fr\/wp-json\/wp\/v2\/posts\/162297\/revisions"}],"predecessor-version":[{"id":162307,"href":"https:\/\/jfrog.com\/fr\/wp-json\/wp\/v2\/posts\/162297\/revisions\/162307"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/jfrog.com\/fr\/wp-json\/wp\/v2\/media\/158398"}],"wp:attachment":[{"href":"https:\/\/jfrog.com\/fr\/wp-json\/wp\/v2\/media?parent=162297"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/jfrog.com\/fr\/wp-json\/wp\/v2\/categories?post=162297"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/jfrog.com\/fr\/wp-json\/wp\/v2\/tags?post=162297"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}