Software supply chain company JFrog Ltd. today launched JFrog Curation, an automated DevSecOps solution that checks and blocks infected open-source or third-party software packages and their dependencies before they enter a company’s development pipeline.

With a large proportion of modern software development relying heavily on open-source libraries, JFrog Curation has been designed to tackle the security risks open-source software can introduce to the development pipeline. According to the company, an estimated 90% of developers utilize open-source components when building proprietary applications and although the components accelerate project delivery, they often introduce vulnerabilities that increase the risk of software supply chain attacks.

JFrog Curation addresses these vulnerabilities head-on by integrating with the company’s Software Supply Chain Platform for centralized control and automated enforcement of security policies. The proactive approach allows for vetting and blocking potentially compromised packages before they can be integrated into a company’s software ecosystem, according to JFrog.

The new tool is claimed to be different from other tools in DevSecOps, the practice of integrating security testing at each stage of the software development process. That’s thanks to its use of binary metadata for identifying high-risk packages without requiring the download of each package for scanning. The approach provides an extra layer of security and improves efficiency in the software supply chain process.

Under the hood, JFrog Curation validates incoming software packages against a Security Research library of recorded Critical Vulnerabilities and Exposures and the National Vulnerability Database. It creates a trusted repository of software components, bridging the gap between public package repositories, developers, production and security personas. The measure not only prevents potential security breaches but also mitigates the costs and time associated with remediation efforts down the line.

“Software developers use millions of open source components to accelerate project delivery and gain a competitive edge, but this practice could be abused to inject malicious packages and vulnerabilities to the code – increasing the risk of software supply chain attacks,” Asaf Karas, chief technology office of Security at JFrog, said in a statement. “Application security must be taken seriously and looked at holistically from the point of creation through runtime on edge devices.”

Image: JFrog