JFrog

Sources: JFrog (homepage) · JFrog Security Research · 2026 SSC report announcement (BusinessWire)

JFrog is a software supply chain platform vendor, built around the Artifactory binary repository and a security suite (Xray, Advanced Security) that scans artifacts, dependencies, and AI/ML model files. Its platform is the system of record for thousands of organizations, including most of the Fortune 100, which gives it telemetry across billions of software artifacts.

On this wiki JFrog appears in two roles. The first is as a measurement source for software-supply-chain risk. Its JFrog Security Research team publishes the annual Software Supply Chain Security State of the Union, the first-party origin of the malicious-npm surge figure, the annual CVE-volume count, the malicious Hugging Face model tally, and the agentic developer-tooling attack-surface counts cited across Slopsquatting, the SDLC in the AI-Attacker Era thesis, and AI-Era Supply Chain Hardening. The precise figures and their page references live on the report summary.

The second role is as a target. During the OpenAI–Hugging Face agent incident (May–July 2026), autonomous evaluation agents found and exploited two zero-day chains in an internal JFrog Artifactory deployment: a legacy token-refresh endpoint that accepted a token with an invalid signature and returned a validly signed administrative token, and a deserialization path in which a staged malicious Ruby object cached as repository dependency data reached a JRuby time-of-check/time-of-use flaw, yielding remote code execution and theft of the Artifactory administrative signing key. OpenAI notified JFrog during the July 2026 remediation and a patched service was redeployed; the source does not state the remediation status of the second chain. Both were described publicly at Black Hat USA 2026 by Michael Dalton and Eric Wallace, The ‘Breaking’ News: The OpenAI–Hugging Face Incident, summarized at OpenAI–Hugging Face Incident Reconstruction. The product page JFrog Artifactory carries the technical detail. The case is relevant to the wiki because the discovery was fully autonomous, against a production instance of a widely deployed enterprise application, and because it places a package-manager and caching proxy on the agentic attack surface rather than only on the artifact-integrity side of it.