{"id":9122,"date":"2026-03-19T11:06:20","date_gmt":"2026-03-19T09:06:20","guid":{"rendered":"https:\/\/www.almtoolbox.com\/blog\/?p=9122"},"modified":"2026-03-29T09:32:44","modified_gmt":"2026-03-29T07:32:44","slug":"jfrog-curation-self-managed","status":"publish","type":"post","link":"https:\/\/www.almtoolbox.com\/blog\/jfrog-curation-self-managed\/","title":{"rendered":"JFrog Curation for Closed Environments: How to Block Malicious Packages Before They Enter Your Code"},"content":{"rendered":"\n

Modern organizations build almost every product based on open-source code and third-party dependencies. This accelerates development, but also introduces a dimension of risk: malicious packages (malware), versions with critical security vulnerabilities, licensing issues, or immature and unmaintained dependencies.<\/p>\n\n\n\n

\"jfrog<\/figure>\n\n\n\n
\n
<\/figure>\n<\/div>\n\n\n\n

In most cases, traditional security tools encounter the component only after<\/span> it has already entered the repository, build, or pipeline.<\/p>\n\n\n\n

This is exactly where JFrog Curation<\/strong> comes into the picture: Instead of discovering after the fact that a dangerous component has already entered the organization,
JFrog Curation acts at the point of request and download of the package, blocking problematic components before they become part of the code, build, or application.<\/p>\n\n\n\n

What is the JFrog Curation Package and what does it provide?<\/h2>\n\n\n\n

JFrog Curation<\/strong> is a governance and policy enforcement layer for consuming open-source packages and third-party dependencies. You can think of it as a “gateway” for external packages: Instead of every dependency automatically entering the environment, the organization defines rules that dictate which packages are allowed to be downloaded, which should be blocked, and which require further inspection.<\/p>\n\n\n\n

The solution allows, among other things, to:<\/strong><\/p>\n\n\n\n

    \n
  1. Block packages flagged as malicious.<\/li>\n\n\n\n
  2. Block versions with security vulnerabilities based on severity level or organizational policy.<\/li>\n\n\n\n
  3. Enforce licensing policies.<\/li>\n\n\n\n
  4. Restrict the use of overly old, immature, or unmaintained packages.<\/li>\n\n\n\n
  5. Apply an allowlist and blocklist according to organizational needs.<\/li>\n\n\n\n
  6. Generate an organized audit trail for every block or approval decision.<\/li>\n<\/ol>\n\n\n\n

    The business implication is clear: less reliance on manual decisions, lower risk of dangerous components entering, and more control over the software supply chain.<\/p>\n\n\n\n

    How does JFrog Curation work in a Self-Hosted \/ Self-Managed environment?<\/h2>\n\n\n\n

    In independently managed on-premises \/ Self-Hosted environments, JFrog Curation integrates with the JFrog platform, and specifically with Artifactory and Xray.<\/p>\n\n\n\n

    The model is relatively simple:<\/strong><\/p>\n\n\n\n

      \n
    1. Developers pull packages through Artifactory (during builds, etc.).<\/li>\n\n\n\n
    2. JFrog Curation checks the request against the organization’s policy.<\/li>\n\n\n\n
    3. If the package meets the conditions (policies) – it is allowed for download.<\/li>\n\n\n\n
    4. If the package violates the policy, access is blocked before the component enters the environment.<\/li>\n<\/ol>\n\n\n\n

      In other words, instead of settling for a post-download scan, the organization gets a prevention<\/strong> mechanism right at the entry stage.<\/p>\n\n\n\n

      This is a fundamental shift: less “cleaning up after,” more upfront prevention.<\/p>\n\n\n\n

      What actually happens during a package request?<\/h2>\n\n\n\n

      When a developer, pipeline, or build requests a dependency through an organizational repository, the system checks whether the package:<\/p>\n\n\n\n