Stop Risky Components Entering Your Software Supply Chain

Every package, AI asset, and IDE extension vetted at the point of request. Risky ones blocked, policy-compliant versions served automatically.

Start Free Trial Take a Tour

What is JFrog Curation?

JFrog Curation automatically stops risky open-source packages, AI assets, IDE extensions, and other third-party components before they ever reach your developers. Every component is vetted automatically, enforcing your security, compliance, and operational policies across every team, site, and region. When a component violates policy, JFrog automatically delivers the next safe, compliant version instead. Developers keep building. Security teams stop fighting fires.

See it in Action

Block Threats Before They're Reported

Attackers hide malicious code in trusted packages through typosquatting and maintainer hijacking. JFrog's research team flags these threats, often before public databases do. An immaturity policy then holds new versions for 14 days, giving the community time to flag a poisoned release. You set the policy on severity, license, or package age, and Curation enforces it.

No Broken Builds

When a package violates policy, Curation’s Compliant Version Selection automatically and transparently serves the highest compliant version in its place, across direct and transitive dependencies, so the build never breaks and the developer stays in flow. It is unique to JFrog.

Policy-Governed Waivers, Full Audit Log

Waivers let developers request access from within their workflow when a package is blocked and no compliant version exists. If your policy allows it, the request is approved instantly or sent to an approver. Waivers expire, so exceptions never become permanent, and every request, block, and approval is logged for audit.

Govern Every AI-Driven Request

AI agents pull dependencies at machine speed. Through JFrog's MCP server, every agent is governed by the same Curation policies as your developers, blocked the moment it reaches for a risky package and handed a compliant version instead. The code your agents pull is vetted and logged, the same as everything else your teams consume.

Global Enforcement, Zero Gaps

Curation enforces your policies at the point of request, on every site and in every region. Package Traffic Controller catches requests that try to skip Artifactory and pull straight from a public registry. Curation Federation allows you to set policy once and it is enforced at every site, in every region. Nothing routes around the gate.

Extensive coverage across every component type.

Whatever assets your developers consume, JFrog Curation governs them, powered by the JFrog Catalog across 18 million+ components and counting.

[Learn More](/content/integrations/ "Learn More"/index.html)

Proven at Enterprise Scale

Deliver measurable business impact with automated upstream package governance that blocks threats instantly.

-179% of malicious components blocked at point of request

-9.57x 5.27x ROI for a 7,000 developer enterprise over three years

-62% faster mean time to remediation for JFrog Curation customers across enterprise deployments

Global Enterprises Trust JFrog Curation to Make Open Source Consumption Safe by Default

Discover how global enterprises deploy our automated OSS curation tool to strengthen software supply chain security from code to production.

"Our Curation deployment provides very effective and efficient supply chain protection. We were able to shut down recent provider attacks in mere minutes once discovered and the control has proven 100% successful since."

Sr. Cybersecurity Executive, Leading Financial Services Company

"JFrog Curation is a firewall for open-source packages. It's about how we can help developers continue their work without disrupting their workflow. We enable development, we don't block it."

Supun Vidana Pathiranage, DevSecOps Specialist, Adyen

"With JFrog Curation and Xray, we have a genuine firewall for our dependencies. Developers can pull what they need, but every package has already been audited, verified, and cleared before they ever touch it. Security becomes a property of the environment, not a step they have to remember."

Clemence Saussez, Staff Cloud Security Engineer, Ledger

"Adding JFrog Curation and Advanced Security to our pipelines allowed us to enhance our security throughout the lifecycle of our products."

Brett Smith, Distinguished Software Developer, SAS

"With JFrog Curation, we're truly shifting left because we're now able to block malicious packages and risky components before they even enter our cloud instance, easing the minds of our security leadership team."

Head of Software Engineering, Leading Healthcare Provider, EMEA

Sr. Cybersecurity Executive, Leading Financial Services Company

Supun Vidana Pathiranage, DevSecOps Specialist, Adyen

Clemence Saussez, Staff Cloud Security Engineer, Ledger

"Adding JFrog Curation and Advanced Security to our pipelines allowed us to enhance our security throughout the lifecycle of our products."

Brett Smith, Distinguished Software Developer, SAS

Head of Software Engineering, Leading Healthcare Provider, EMEA

Sr. Cybersecurity Executive, Leading Financial Services Company

• 1
• 2
• 3
• 4
• 5

Frequently Asked Questions

• Why is software composition analysis (SCA) not enough to stop supply chain attacks?
  Traditional SCA relies on vulnerability databases, meaning it cannot block unknown or immature packages before they enter your organization. This leaves developer workstations exposed to attacks the moment an unvetted package is downloaded. Curation prevents this by enforcing immaturity policies at intake, stopping new vulnerabilities at the front door rather than reacting after a breach.

• How does JFrog Curation help organizations comply with Executive Order 14028 / EU Cyber Resilience Act?
  Both the Executive Order 14028 and the EU Cyber Resilience Act require verifying open-source components before integration, not after. Curation enforces policy at the moment a component is requested and logs every request, block, and approval automatically. That immutable record is the documented evidence both frameworks require, produced as a byproduct of how your developers already work.

• How does JFrog secure open source AI assets before using them in production?
  Curation treats AI assets as first-class components, applying the same policy enforcement to models from Hugging Face and NVIDIA NIM as it does to packages. Every model is evaluated against your policies before it enters your environment, with verified intelligence across 97.1% of Hugging Face models and 18M+ components in the Catalog.

• How does JFrog block malicious open source packages before they enter the build pipeline?
  When a developer, CI pipeline, or AI agent requests a package, JFrog Curation checks it against the JFrog Catalog, a ready-made record of millions of packages, instead of downloading and scanning the file. If the package is malicious, vulnerable, or breaks your policy on things like license or package age, Curation blocks. Because it checks the JFrog Catalog instead of downloading each file, without delay even when a pipeline is resolving hundreds of packages at once. Risky packages never reach your developers.

• How does JFrog Curation detect malicious packages that have not been flagged in public vulnerability databases?
  JFrog’s security research team runs automated scanners that flag malicious behavior, like data exfiltration, dependency confusion, and typosquatting, and builds a maliciousness score before any CVE is filed. JFrog Catalog continuously analyzes each component’s metadata, behavior, and provenance, so Curation can block a threat on JFrog’s own intelligence, ahead of public databases.

• What happens when a developer needs a blocked package?
  Usually a developer never notices: Curation serves a compliant version and the build continues. If none exists, the developer requests a waiver from their workflow, no ticket needed, and it clears instantly or routes to an approver per your policy. Waivers can expire, so access never becomes a permanent exception.

• Does Curation cover packages already in my cache?
  Yes, when Enforce Policy on Cached Packages is enabled. Curation’s default is to stop risky packages at the point of request, but a package that was safe when downloaded can later be discovered as malicious. With this setting on, Curation applies current policy to cached packages and blocks any whose security posture has changed.