{"id":26249,"date":"2026-09-23T23:00:53","date_gmt":"2026-09-24T07:00:53","guid":{"rendered":"https:\/\/www.palada.net\/index.php\/2026\/09\/23\/get-the-spectra-assure-community-plugin-for-jfrog-artifactory-2\/"},"modified":"2026-09-23T23:00:53","modified_gmt":"2026-09-24T07:00:53","slug":"get-the-spectra-assure-community-plugin-for-jfrog-artifactory-2","status":"publish","type":"post","link":"https:\/\/www.palada.net\/index.php\/2026\/09\/23\/get-the-spectra-assure-community-plugin-for-jfrog-artifactory-2\/","title":{"rendered":"Get the Spectra Assure Community Plugin for JFrog Artifactory"},"content":{"rendered":"
\n
\n

Even with JFrog Artifactory proxying public open-source software (OSS) registries, package managers like npm and pip will typically pull the newest version of a dependency \u2014 even if it was published just moments before. That’s convenient \u2014 but it’s also the workflow attackers have learned to exploit.<\/p>\n

Malicious OSS packages aren’t a one-off problem anymore. They’re a recurring campaign. For example, the Shai-Hulud worm is now on its fourth iteration. Trivy, Axios, and LiteLLM have all seen compromised releases. Attackers have found ways to smuggle payloads through npm’s binding.gyp<\/em>, and even a Checkmarx VS Code extension got hit. The common thread: a trusted maintainer’s credentials get compromised, a malicious version gets published to npm or PyPI, and any repo set up to auto-update just pulls in the new version \u2014 no testing needed.<\/em><\/p>\n

To close that gap, ReversingLabs has released a free integration for JFrog Artifactory<\/span><\/a>, a native plugin for self-managed instances of Artifactory that checks every OSS package request against insights from Spectra Assure Community<\/span><\/a> before letting it through.<\/p>\n

For those who are new to our Community platform<\/span><\/a>, it delivers real-time threat intelligence on millions of OSS packages, Model Context Protocol (MCP) servers, and developer tools from public repositories like npm and PyPI. It continuously monitors those repositories for new packages to analyze. As new threats emerge its entire package repository is reanalyzed and updated reports are published. Teams can automate safety checks and policy enforcement with the platform\u2019s API<\/span><\/a>\u00a0 \u2014 and with our new plugin.<\/p>\n

[ Learn more: <\/strong>Why RL Built Spectra Assure Community<\/strong><\/a> | <\/strong>Sign up for free<\/strong><\/a>]<\/strong><\/p>\n

The Problem: Artifactory Was Never Built to Vet Packages<\/strong><\/h2>\n

For many development teams, Artifactory is where software artifacts are stored, where CI\/CD pipelines pull OSS and third-party dependencies from, and where builds and release candidates are kept. Repositories stored and shared on Artifactory are typically considered \u201cinternal\u201d to the organization, so it is easy to assume the contents are safe. However, repositories do not judge on their own whether a package is safe or not.<\/p>\n

That gap gets exploited two ways. Compromised packages are pulled into build pipelines, then incorporated into releases and shipped to customers, or they land on developer workstations that often have credentials and access to sensitive systems. Either way, the automation that makes Artifactory convenient is the same automation that spreads a risky package before anyone notices.<\/p>\n

How the Plugin Works<\/strong><\/h3>\n

The plugin runs in-process with Artifactory \u2014 it’s not a separate service or proxy that needs to be deployed. Because it loads as part of Artifactory itself, it sees every incoming artifact request, making it a same-day way to start blocking the next Shai-Hulud before it reaches a build or infects a developer\u2019s workstation.<\/p>\n

    \n
  1. Intercept.<\/strong> The plugin checks artifact properties on every incoming download request for npm, PyPI, Maven, NuGet, or RubyGems packages.<\/li>\n
  2. Check Freshness.<\/strong> If that package version hasn’t been checked recently (24 hours by default, configurable), the plugin calls the Spectra Assure Community API.<\/li>\n
  3. Evaluate and Tag.<\/strong> The response gets parsed and written back as secure.software.*<\/em> properties on the artifact \u2014 status, hash, PURL, publish date, and more.<\/li>\n
  4. Allow or Block.<\/strong> A pass<\/em> or warning<\/em> status lets the download proceed normally. A fail status returns an HTTP 403 to the client, with a link to the full Spectra Assure Community report so the developer can see exactly why it was blocked.<\/li>\n<\/ol>\n
    \n