Datadog Supply Chain Firewall: Block Malicious npm and pip Packages Before They Install
Datadog's open-source Supply Chain Firewall checks npm, pip, and poetry installs against threat databases and blocks malicious packages before they install.
Coding Agents Are Pulling Packages Your Security Team Can't See
AI coding agents like Cursor and Claude Code bypass traditional package governance by pulling dependencies directly from public registries. JFrog's agent package resolution closes that gap before the next supply chain incident.
JFrog Fly Graduates: What an Agentic Repository Actually Means for Enterprise CI/CD
JFrog Fly's agentic repository capabilities are now part of the main JFrog Platform. The experiment is over. The question now is what enterprise teams do with it.
JFrog Artifactory and GCP Artifact Registry: Native Pull, No Sync Required
JFrog's Artifact Registry Connector routes Cloud Run and GKE pulls directly to Artifactory in real time — eliminating sync lag, parallel registries, and policy enforcement gaps.
NuGet Typosquat: How One Extra Letter Rigged a Betting Platform's Odds
JFrog uncovered Newtonsoftt.Json.Net, a typosquatted NuGet package that patched a betting platform's game logic to rig crash-game outcomes on a schedule only the attacker knew.
AI Agents Now Have a Package Manager — and JFrog Is the Enterprise Registry
APM (Agent Package Manager) treats agent primitives like versioned software packages. JFrog's Artifactory adds native support, bringing supply-chain governance to AI agent configuration.
JFrog Artifactory Adds Xet Protocol Support: How Enterprise Model Distribution Finally Scales
JFrog Artifactory's native Xet protocol support brings chunk-level deduplication to Hugging Face model distribution — delivering up to 3.7x faster subsequent pulls and controlled storage growth for enterprises managing fine-tuned model variants.
npm v12's Biggest Security Change: Installation Scripts Now Need Your Permission
npm v12 disables lifecycle scripts, Git dependencies, and remote URL resolution by default — an explicit trust model that blocks 53% of malicious npm attacks and requires teams to audit their CI/CD pipelines before upgrading.
JFrog Just Put NVIDIA NIM Models Into Your Software Supply Chain
NVIDIA NIM inference microservices used to bypass organizational supply chain controls entirely — pulled directly from NVIDIA's NGC registry with no versioning, scanning, or audit trails. JFrog AI Catalog now treats NIM models as governed artifacts alongside every other dependency.
Datadog's BewAIre: From 97.4% to 99.86% Accuracy on Malicious Package Detection
Datadog's BewAIre system detects malicious code in npm and PyPI packages with 99.86% accuracy using a two-stage AI pipeline — a lightweight filter that exits 95% of packages cheaply, then an agentic investigation loop for everything that looks suspicious.
Helm's Former APT Mirror Was Taken Over. Here's What to Check.
The baltocdn.com domain that hosted Helm packages changed ownership May 19, 2026 and may be serving malicious content. Audit your CI pipelines, Dockerfiles, and scripts now.
JFrog's Package Traffic Controller Closes the Last Open Door in Supply Chain Security
AI agents bypass artifact repos entirely. JFrog's new network-layer tool intercepts every outbound package request — developers, agents, and everyone else — and routes it through curation policy.
JFrog Curation: How Compliant Version Selection Stops Policies From Breaking Builds
JFrog's Compliant Version Selection routes blocked packages to the highest policy-compliant version — keeping builds green without relaxing security controls.