Driven by a “Liquid Software” vision, the JFrog Software Supply Chain Platform powers organizations to build, manage, and distribute software quickly & securely
🌎
Joined May 2009
- Tweets18.5K
- Following2.3K
- Followers23.3K
- Likes6.5K
JFrog retweeted
We're proud to sponsor @JFrog swampUP in Barcelona! Visit us at the CloudBees booth to learn how we can help make sure the code you write delivers the business impact you want — safely and securely.
See the CloudBees events calendar for details: cloudbees.com/events?Product…
ALT Invitation to JFrog swampUP 2026 conference featuring CloudBees. The event is titled "Trusted Intelligence: Master the AI Surge" and will be held from October 20-22, 2026, in Barcelona, Europe. Logos of JFrog and CloudBees are included.
JFrog retweeted
🚨 Anatomy of a Live npm Supply-Chain Campaign: "Equation of Compromise"
Threat actors are targeting developers with trojanized math libraries. The payload doesn't run for everyone, it only decrypts when the victim's code solves one specific linear matrix.
Read the full teardown of the trigger, payloads, and threat actor infrastructure on our blog: research.jfrog.com/post/equa…
JFrog retweeted
The JFrog Security Research team investigated the GemStuffer campaign run by rogue OpenAI agents and uncovered over 3,000 malicious RubyGems packages, beyond initial estimates.
The wildest part? The AI left distinct fingerprints across the registry.
How the agent swarm operated and the full list of 3,000+ packages: research.jfrog.com/post/gems…
JFrog retweeted
I had an interesting conversation last week with JFrog’s chief financial officer, Ed Grabscheid, regarding how to think about the company’s opportunity securing binaries in an age of artificial intelligence. It’s challenging to be suddenly thrust in the middle of investor expectations for a red-hot market.
For JFrog’s CFO, a balancing act between AI exuberance and what’s reasonable
Software maker JFrog organizes the binary files a programmer makes. In an era when AI spells both opportunity and disaster for programmers, the company has an attractive pathway to expand its value through many more features. It’s already showing up in the numbers. It’s down to CFO Ed Grabscheid to keep expectations tethered to reality.
thetechnologyletter.com
$FROG
@jfrog
JFrog retweeted
🚨NextJS, Sharp and ImagicMagick affected by Critical libheif vulnerability 🚨
A heap buffer overflow CVE-2026-84383 in libheif (along with 10 other vulnerabilities) has been reported to result in RCE when parsing malformed HEIC/HEIF/AVIF images.
Popular web tools parsing AVIFS like @nextjs and sharp were reported as affected. The JFrog security research team found that @ImageMagick is also affected by the vulnerability and verified a DoS POC.
Users are recommended to upgrade:
- libheif to version 1.23.2
- sharp to version 0.35.4
- next.js to versions 15.5.24 or 16.3.3
🔎 Note that other popular tools utilizing libheif may be affected.
JFrog retweeted
📊 Widely used open-source packages can become a liability once upstream patching ends.
TuxCare SecureChain and @jfrog are changing that with patched, malware-screened packages and automated fixes through JFrog Zero-Touch Remediation.
👇 Learn more:
tuxcare.com/blog/tuxcare-joi…
JFrog retweeted
Well said, @rauchg. The entire industry is in a race against attackers, moving at the pace that cyber-capable models now set. No company wins this fight alone. Cybersecurity's future depends on partnership across researchers, vendors, customers, and AI labs.
A bit more color on CVE-2026-82329 for anyone following along: 1/ it is unrelated to the OpenAI/Hugging Face incident (we've been working closely with OpenAI on that one), 2/ it is improper authentication rather than RCE, and 3/ it does not affect the JFrog SaaS platform, only self-hosted deployments. You saw the same dynamic with Next.js CVE-2025-29927 (CVSS 9.1), which hit self-hosted apps but not Vercel's platform.
Our job as platform providers is to detect, remediate fast, and keep giving customers a clear path forward.
In the long run, defenders win. The same AI that probes for weaknesses will find, patch, and harden faster than attackers can exploit, and the software supply chain, including the binaries system of record, comes out healthier than it has ever been.
JFrog retweeted
Read our full technical analysis at: research.jfrog.com/post/shai…
🚨 SUPPLY CHAIN ALERT: Popular npm package @7nohe/openapi-react-query-codegen (~200K downloads/mo) was compromised on Aug 28.
Threat actors hijacked an insecure GitHub Actions workflow to publish 10 malicious versions carrying a Bun-based malware payload.
Compromised Versions:
0.5.4, 0.5.5
1.6.3, 1.6.4
2.2.1, 2.2.2
3.0.3, 3.0.4
0.0.0-365d4eb738d3146583431948d3ba6e27a32556be
0.0.0-ec7876d6c917dad516ba69bbfafc948b834bf0ab
JFrog retweeted
AI coding agents burn a surprising amount of context on stuff they probably never needed to read.
Test logs. CLI output. Repeated code searches.
@yahav_ohana and @ShayFrektman from JFrog built a free CLI called Boost that compresses that noise before it reaches the model.
One test went from 232 lines → 22 while keeping the actual failure intact.
Here’s how it works 👇
🤝 Paid partnership
JFrog retweeted
🚨 Compromised Rust crate on crates.io!
The Packages arrayref (~245M downloads) v0.3.10, append-only-vec v0.1.9, and internment v0.8.7 have been compromised!
They all silently pulled in proc-macro1, a typosquat of proc-macro2. Its build.rs downloads a remote payload and executes it on any machine that runs cargo build - nothing from the crate even needs to be called.
Check your Cargo.lock for the compromised packages or any proc-macro1 entry.
JFrog retweeted
🚨 A new wave of Shai Hulud malware hits npm 🚨
About 26 packages are already confirmed as compromised.
Full technical details will be updated on our blog:
research.jfrog.com/post/shai…
JFrog retweeted
A few days ago,
I hosted a webinar about:
- AI coding agents
- Software supply chain security
- How malicious dependencies enter modern workflows
Thanks to everyone who joined!
It was a very interesting session with @JFrog
Start your free trial here: jfrog.com/curation/
JFrog retweeted
CVSS 10.0, but the evidence doesn't add up.
CVE-2026-51302 in SQLite claims critical impact, but:
❌The supplied PoC does not reproduce
❌The source code does not match the claims
And it's not an isolated case: JFrog found the same issues in 54 of 55 CVEs published by the same GitHub repository in just 4 days, and informed in the proper CVE channels.
⚠️Don't blindly trust newly published CVEs. Validate the advisory, PoC, and source before prioritizing or patching.
JFrog retweeted
📢 オンラインセミナー開催
「セキュリティ投資の意思決定を変える、AI時代のサプライチェーンリスク」
～AIセキュリティを経営はどう統制するか～
生成AIの活用が加速する中、企業が管理すべき対象はソースコードだけではありません。
OSSパッケージ、AIが生成したコード、AIエージェントなど、新たなリスクへの対応は、開発部門だけでなく経営やセキュリティ部門にとっても重要なテーマとなっています。
本セミナーでは、AI時代に求められるソフトウェアサプライチェーンガバナンスの考え方と、実践的なアプローチをご紹介します。
📅 2026年8月6日（木）18:00～19:00
💻 オンライン（TECH PLAY）
🎟️ 参加無料
▼お申し込みはこちら🐸
techplay.jp/event/998336
#DevSecOps #ソフトウェアサプライチェーン #AIセキュリティ #OSS #AIエージェント
JFrog retweeted
⚠️False Positive Alert: OSV advisory MAL-2026-10726 has incorrectly flagged [email protected] (3M weekly downloads) as malicious.
The claims of "typosquatting" are incorrect. These are legitimate dependencies with an established history and normal PR reviews. Astro is 100% safe.
Advisory: osv.dev/vulnerability/MAL-20…
JFrog retweeted
🚨Since when does a documentation improvement become a Critical vulnerability?
Apparently, CVE-2026-59084.
Apache Tomcat's EncryptInterceptor docs didn't warn that non-default algorithms like AES/CBC leave replay protection ineffective.
The fix? Updated documentation. Zero lines of code changed.
CISA rated it 9.1 Critical. Apache rated it Low. JFrog's analysis agrees with Apache.
JFrog retweeted
🚨 The Miasma worm has returned to npm! Four AsyncAPI packages were recently compromised to deliver the new Miasma v3 variant.
Read our full technical analysis:
research.jfrog.com/post/mias…
🚨 NPM SUPPLY CHAIN ATTACK ALERT 🚨
For the second time, packages in the AsyncAPI ecosystem have been compromised. After being targeted by the massive "Shai-Hulud: The Second Coming" worm attack, @asyncapi/generator (100k weekly downloads) and its sub-packages have been poisoned again.
@asyncapi/generator (3.3.1)
@asyncapi/generator-helpers (1.1.1)
@asyncapi/generator-components (0.7.1)
Check your build pipelines and dependencies immediately! 🛡️
JFrog retweeted
⚠️ Students visiting "Riverbend Tutoring" to bypass school Wi-Fi and play games didn't realize their browsers were being conscripted into a DDoS botnet.
We deobfuscated a massive campaign of 150+ npm packages (under names like charlie-kirk and ilovefemboys) acting as a free CDN for malicious student web proxies.
Our deep-dive recovered active payloads: a mutable remote loader and a custom Wisp-protocol WebSocket generator that attacked a nursing school's website at 2MB/s per visitor.
How the Lucide campaign weaponized student proxies:
research.jfrog.com/post/luci…
JFrog retweeted
🚨 IronWorm returns! Shai-Hulud's rustier cousin has struck again, and it’s more sophisticated than ever. 🐛
An evolved variant of the infostealer has been discovered hiding in compromised versions of the popular jscrambler npm package (15k weekly downloads).
Read the full technical deep dive from the JFrog Security Research team: research.jfrog.com/post/iron…
🚨SUPPLY CHAIN ALERT
The official jscrambler npm package (15K weekly downloads) has been hijacked! Version 8.14.0 includes a malicious preinstall script that drops a hidden Rust binary disguised as a .js file on Windows, macOS, and Linux.
The payload is a highly evasive credential and crypto-wallet stealer, featuring advanced anti-analysis tools and kernel-level eBPF instrumentation.
If you installed v8.14.0, consider your system compromised. Immediately rotate all of your credentials!
XRAY-1025905
JFrog retweeted
I'm back from Berlin!
On July 28, I’ll join Mark Whitby for a live @jfrog webinar on securing DevOps pipelines from risky AI agents and malicious dependencies.
We’ll demo real attacks and how to stop them before they ship.
📅July 28, 10 AM CEST
🔗Link below
Let’s crush it!
ALT Francesco pointing at the webinar info