ReversingLabs Releases Artifactory Plugin to Block Risky Open-Source Packages
Summary
ReversingLabs’ free Artifactory plugin checks npm, PyPI, Maven, NuGet and RubyGems package requests against Spectra Assure Community intelligence, allowing teams to block packages flagged as risky.
Key points
- The plugin runs within self-managed JFrog Artifactory and checks incoming requests for supported package ecosystems.
- It queries Spectra Assure Community when a package version has not been checked recently; the default freshness interval is 24 hours and is configurable.
- Pass or warning results allow downloads, while a fail result blocks the request with HTTP 403 and links to the package report.
- The plugin uses previously generated Community analysis rather than running the Spectra Assure binary-analysis engine for each request.
- Preset Minimum, Baseline and Hardened profiles offer different blocking criteria; package-age settings can add a publication cooldown.
- The plugin is available on the free Community tier, which includes 100,000 API lookups per month.
Article Details
- Event Type
- Release of a free Spectra Assure Community plugin for self-managed JFrog Artifactory instances.
- Impact
- The plugin checks incoming package requests against Spectra Assure Community threat intelligence and can block packages marked as failed, helping reduce the risk of malicious or otherwise risky dependencies entering build pipelines or developer workstations. The article describes the intended capability; it does not report a confirmed attack or measured impact.
Malware
Vendors
JFrogEven with JFrog Artifactory proxying public open-source software (OSS) registries, package managers like npm and pip will typically pull the newest version of a dependency — even if it was published just moments before.ReversingLabsTo close that gap, ReversingLabs has released a free integration for JFrog Artifactory, a native plugin for self-managed instances of Artifactory that checks every OSS package request against insights from Spectra
Products
Claude Code SkillsClaude Code Skills and MCP Server Integrations teach AI-coding assistants to check OSS dependencies before they are picked, pre-commit.JFrog ArtifactoryEven with JFrog Artifactory proxying public open-source software (OSS) registries, package managers like npm and pip will typically pull the newest version of a dependency — even if it was published just moments before.MavenIntercept. The plugin checks artifact properties on every incoming download request for npm, PyPI, Maven, NuGet, or RubyGems packages.npmEven with JFrog Artifactory proxying public open-source software (OSS) registries, package managers like npm and pip will typically pull the newest version of a dependency — even if it was published just moments before.NuGetIntercept. The plugin checks artifact properties on every incoming download request for npm, PyPI, Maven, NuGet, or RubyGems packages.PyPIthread: a trusted maintainer's credentials get compromised, a malicious version gets published to npm or PyPI, and any repo set up to auto-update just pulls in the new version — no testing needed.RubyGemsIntercept. The plugin checks artifact properties on every incoming download request for npm, PyPI, Maven, NuGet, or RubyGems packages.Spectra Assure Communityinstances of Artifactory that checks every OSS package request against insights from Spectra Assure Community before letting it through.