JFrog Curation

JFrog Curation is an automated open-source software dependency governance and security curation solution designed to intercept, audit, and block malicious, vulnerable, and unauthorized third-party open-source packages before they enter developer environments or central artifact repositories. Functioning as a pre-ingestion security gate, it prevents software supply chain attacks at the developer perimeter.

Operating as an automated security proxy layer for JFrog Artifactory, the platform inspects package download requests originating from developer command-line tools (such as npm install, pip install, and mvn clean). Core technical capabilities include automated inspection against proprietary and public vulnerability databases, detection of malicious open-source packages (such as typosquatting, dependency confusion, and hijacked accounts), open-source license compliance evaluation, and automated policy enforcement that blocks non-compliant packages while caching approved packages. Developers receive immediate, actionable explanations when a requested package is blocked.

Enterprises, fintech platforms, and regulated technology organizations deploy JFrog Curation to protect their developers from malicious open-source packages and prevent toxic dependencies from contaminating internal software builds. It integrates natively with JFrog Artifactory and package managers across JavaScript, Python, Java, and Go. Common operational use cases include stopping zero-day malware embedded in public npm packages, enforcing corporate open-source license policies, preventing dependency confusion exploits, and eliminating developer rework by establishing automated software supply chain curation at the front door.