JFrog has announced the introduction of JFrog Curation, an automated DevSecOps solution designed to thoroughly inspect and block contaminated open-source or third-party software packages and their respective dependencies before they enter a company’s software development environment.
JFrog Curation, which is integrated with JFrog Artifactory, uses binary metadata for the identification of high-risk packages with high-severity CVEs as well as operational or license compliance issues. This eliminates the need to download each package for scanning before use, thereby maintaining developer speed and convenience.
“A lot of companies don’t have control. And because of the need for speed, developers are pulling down all kinds of packages from NPM, Maven, and Go. The other bad option is, ‘Hey, I can place a whole bunch of restrictions on my software development team, but it’s gonna kill my software development velocity so I have to figure out a way to enable my development team without slowing down my development.’ At the same time, they want to be able to know that they’re using trusted packages,” said Paul Garden, who heads up the JFrog Xray and DevSecOps outbound product marketing function at JFrog. “So essentially, that’s the big problem we’re solving. And we’ve actually been working with a couple of our strategic customers for nearly two years on how we approach this problem.”
JFrog Curation verifies incoming software packages against JFrog’s Security Research library of recorded Critical Vulnerabilities Exposures (CVE) and publicly available information. This process helps create a trusted repository of pre-approved, third-party software components for development use. By bridging the gap between public package repositories, developers, production, and security personas, JFrog Curation improves efficiency and helps avoid time-consuming and costly fixes down the line.
The tool provides centralized visibility and governance of every open-source package requested by a developer or build tool, offering accurate, metadata-based insights on all compromised packages, with practical suggestions for remediation.
“Security incidents such as log4Shell, Spring4Shell, etc., have taught us that what’s safe today may not be safe tomorrow when using public open-source libraries,” said Jim Mercer, research vice president of DevOps and DevSecOps at IDC. “A tool that simplifies the developer experience while ensuring packages comply with established, regularly updated security policies, and are validated against relevant vulnerability databases, is essential for securing modern DevOps workflows.”
JFrog Curation also allows the creation of a comprehensive and transparent audit trail, assisting organizations in complying with current and future regulatory requirements. It enhances the developer experience by facilitating the retrieval of vetted software components with minimal friction.
The tool also helps to prevent the excessive spread of different tool suites through its integration with the JFrog Software Supply Chain Platform, which offers consistent, automated processes across development environments.
