Spectra Assure Free Trial
Get your 14-day free trial of Spectra Assure for Software Supply Chain Security
Get Free TrialMore about Spectra Assure Free Trial
Even with JFrog Artifactory proxying public open-source software (OSS) registries, package managers like npm and pip will typically pull the newest version of a dependency — even if it was published just moments before. That's convenient — but it's also the workflow attackers have learned to exploit.
Malicious OSS packages aren't a one-off problem anymore. They're a recurring campaign. For example, the Shai-Hulud worm is now on its fourth iteration. Trivy, Axios, and LiteLLM have all seen compromised releases. Attackers have found ways to smuggle payloads through npm's binding.gyp, and even a Checkmarx VS Code extension got hit. The common thread: a trusted maintainer's credentials get compromised, a malicious version gets published to npm or PyPI, and any repo set up to auto-update just pulls in the new version — no testing needed.
To close that gap, ReversingLabs has released a free integration for JFrog Artifactory, a native plugin for self-managed instances of Artifactory that checks every OSS package request against insights from Spectra Assure Community before letting it through.
For those who are new to our Community platform, it delivers real-time threat intelligence on millions of OSS packages, Model Context Protocol (MCP) servers, and developer tools from public repositories like npm and PyPI. It continuously monitors those repositories for new packages to analyze. As new threats emerge its entire package repository is reanalyzed and updated reports are published. Teams can automate safety checks and policy enforcement with the platform’s API — and with our new plugin.
[ Learn more: Why RL Built Spectra Assure Community | Sign up for free]
For many development teams, Artifactory is where software artifacts are stored, where CI/CD pipelines pull OSS and third-party dependencies from, and where builds and release candidates are kept. Repositories stored and shared on Artifactory are typically considered “internal” to the organization, so it is easy to assume the contents are safe. However, repositories do not judge on their own whether a package is safe or not.
That gap gets exploited two ways. Compromised packages are pulled into build pipelines, then incorporated into releases and shipped to customers, or they land on developer workstations that often have credentials and access to sensitive systems. Either way, the automation that makes Artifactory convenient is the same automation that spreads a risky package before anyone notices.
The plugin runs in-process with Artifactory — it's not a separate service or proxy that needs to be deployed. Because it loads as part of Artifactory itself, it sees every incoming artifact request, making it a same-day way to start blocking the next Shai-Hulud before it reaches a build or infects a developer’s workstation.
Figure 1: How The Spectra Assure Community Plugin for JFrog Artifactory Works
Important detail: this is a lookup, not a scan. The plugin isn't running the Spectra Assure binary analysis engine itself; that important task already happened when the package was indexed in Community. That's what keeps it fast enough to check every download request without adding noticeable latency.
You also get policy control to enforce governance rules. The plugin ships with three preset profiles that set how strict the blocking criteria are:
On top of whichever profile you choose, min_package_age and min_version_age settings let you enforce a cool-down period — refusing packages or versions until they've been publicly available for a specified number of days — which closes the window attackers rely on when they publish a malicious OSS package and hope it gets picked up before anyone notices.
If you're already using other Spectra Assure Community integrations, the Artifactory plugin covers a different point in the pipeline than the others:
This ships on the free Spectra Assure Community tier — 100k API lookups per month. No binary scanning limits, full plugin functionality. If you outgrow that, the Community+ tier raises the ceiling to one million lookups per month. There's no commercial discussion to get started; if it proves out, that happens later.
The plugin and full setup docs live in the Spectra Assure Community Toolbox menu under "For JFrog Artifactory," or directly on GitHub. Installation is four files — the Groovy plugin script, a properties file, a jar, and your selected policy file — dropped into the standard Artifactory plugins directory, followed by a plugin reload or restart. Full details, including all supported configuration options, are in the Community integrations documentation.
Explore RL's Spectra suite: Spectra Assure for software supply chain security, Spectra Detect for scalable file analysis, Spectra Analyze for malware analysis and threat hunting, and Spectra Intelligence for reputation data and intelligence.
ReversingLabs built a Spectra Analyze integration with CrowdStrike Falcon. The connector is available now as part of Spectra Analyze v9.6.0.
Here's how to use Spectra Analyze to hunt for malicious SVGs, from setting up queries and evaluations of samples to tips for investigation.
Spectra Detect is now Kubernetes-native. Spectra Analyze adds AI workflows for the agentic SOC. Here's everything that shipped.
