Get the Spectra Assure Community Plugin for JFrog Artifactory

Even with JFrog Artifactory proxying public open-source software (OSS) registries, package managers like npm and pip will typically pull the newest version of a dependency — even if it was published just moments before. That’s convenient — but it’s also the workflow attackers have learned to exploit.

Malicious OSS packages aren’t a one-off problem anymore. They’re a recurring campaign. For example, the Shai-Hulud worm is now on its fourth iteration. Trivy, Axios, and LiteLLM have all seen compromised releases. Attackers have found ways to smuggle payloads through npm’s binding.gyp, and even a Checkmarx VS Code extension got hit. The common thread: a trusted maintainer’s credentials get compromised, a malicious version gets published to npm or PyPI, and any repo set up to auto-update just pulls in the new version — no testing needed.

To close that gap, ReversingLabs has released a free integration for JFrog Artifactory, a native plugin for self-managed instances of Artifactory that checks every OSS package request against insights from Spectra Assure Community before letting it through.

For those who are new to our Community platform, it delivers real-time threat intelligence on millions of OSS packages, Model Context Protocol (MCP) servers, and developer tools from public repositories like npm and PyPI. It continuously monitors those repositories for new packages to analyze. As new threats emerge its entire package repository is reanalyzed and updated reports are published. Teams can automate safety checks and policy enforcement with the platform’s API  — and with our new plugin.

[ Learn more: Why RL Built Spectra Assure Community | Sign up for free]

The Problem: Artifactory Was Never Built to Vet Packages

For many development teams, Artifactory is where software artifacts are stored, where CI/CD pipelines pull OSS and third-party dependencies from, and where builds and release candidates are kept. Repositories stored and shared on Artifactory are typically considered “internal” to the organization, so it is easy to assume the contents are safe. However, repositories do not judge on their own whether a package is safe or not.

That gap gets exploited two ways. Compromised packages are pulled into build pipelines, then incorporated into releases and shipped to customers, or they land on developer workstations that often have credentials and access to sensitive systems. Either way, the automation that makes Artifactory convenient is the same automation that spreads a risky package before anyone notices.

How the Plugin Works

The plugin runs in-process with Artifactory — it’s not a separate service or proxy that needs to be deployed. Because it loads as part of Artifactory itself, it sees every incoming artifact request, making it a same-day way to start blocking the next Shai-Hulud before it reaches a build or infects a developer’s workstation.

1. Intercept. The plugin checks artifact properties on every incoming download request for npm, PyPI, Maven, NuGet, or RubyGems packages.
2. Check Freshness. If that package version hasn’t been checked recently (24 hours by default, configurable), the plugin calls the Spectra Assure Community API.
3. Evaluate and Tag. The response gets parsed and written back as secure.software.* properties on the artifact — status, hash, PURL, publish date, and more.
4. Allow or Block. A pass or warning status lets the download proceed normally. A fail status returns an HTTP 403 to the client, with a link to the full Spectra Assure Community report so the developer can see exactly why it was blocked.

Figure 1: How The Spectra Assure Community Plugin for JFrog Artifactory Works

Important detail: this is a lookup, not a scan. The plugin isn’t running the Spectra Assure binary analysis engine itself; that important task already happened when the package was indexed in Community. That’s what keeps it fast enough to check every download request without adding noticeable latency. 

You also get policy control to enforce governance rules. The plugin ships with three preset profiles that set how strict the blocking criteria are: 

• Minimum blocks only malicious dependencies vetted by ReversingLabs threat analysts.
• Baseline blocks malware, tampering, and actively exploited vulnerabilities (a solid starting point for typical development use). 
• Hardened is the default and most secure profile. 

On top of whichever profile you choose, min_package_age and min_version_age settings let you enforce a cool-down period — refusing packages or versions until they’ve been publicly available for a specified number of days — which closes the window attackers rely on when they publish a malicious OSS package and hope it gets picked up before anyone notices.

Where It Fits With Other Guardrails

If you’re already using other Spectra Assure Community integrations, the Artifactory plugin covers a different point in the pipeline than the others:

• Claude Code Skills and MCP Server Integrations teach AI-coding assistants to check OSS dependencies before they are picked, pre-commit.
• CI/CD Integration tool rl-protect parses your build manifest and checks supported OSS packages listed before the build runs.
• The Community Artifactory plugin checks packages at the moment they’re requested from your repository — catching anything that is too risky or goes against company policy.

What It Costs: Nothing

This ships on the free Spectra Assure Community tier — 100k API lookups per month. No binary scanning limits, full plugin functionality. If you outgrow that, the Community+ tier raises the ceiling to one million lookups per month. There’s no commercial discussion to get started; if it proves out, that happens later.

The plugin and full setup docs live in the Spectra Assure Community Toolbox menu under “For JFrog Artifactory,” or directly on GitHub. Installation is four files — the Groovy plugin script, a properties file, a jar, and your selected policy file — dropped into the standard Artifactory plugins directory, followed by a plugin reload or restart. Full details, including all supported configuration options, are in the Community integrations documentation.