Welcome to the second post in our series on Malicious Software Packages. This post focuses on the infection methods attackers use to spread malicious packages, and how the JFrog Security research team unveiled them.

Can you imagine a world without software? No, neither can I. The same goes for many other technology-based products, such as cell phones. Software is everywhere and it’s critical to businesses of all sizes. In this article, we discuss the software supply chain risk management process needed to protect your business from risks in the software supply chain and how that affects product development speed in what seems like an ever-changing market landscape.

The software supply chain has been in the news of late, and not for good reasons. Security incidents that have made headlines and led to costly damages have brought a lot of attention to this area. Perhaps the most noteworthy recent example of a vulnerability in the supply chain was the flaw with Apache Log4j discovered in late 2021. Logj4 is a Java package that’s located in the Java logging systems and is essentially a Java library for logging error messages in applications.

Welcome to the first post of the malicious software packages series for the DevOps and DevSecOps community. Each Monday, this technical series will focus on various malicious packages and their effects on the software supply chain, all published over the next four weeks. We’ll dive deeper into malicious packages in each post, including Here we go. Let’s discuss malicious software packages in your software supply chain.

Today marks an exciting day for JFrog and a substantial step forward towards ensuring end-to-end software supply chain security. JFrog Advanced Security is our unique approach for DevOps-centric security, and the only solution that was built especially for today’s modern DevOps workflows.