JFrog

Artifact management and AI supply chains

JFrog provides software artifact management through Artifactory and security scanning through Xray. Its current product descriptions include AI assets, while its public security research examines vulnerabilities and malicious packages in software supply chains. That role concerns the components used to build and run AI applications, rather than training a foundation model. [1][2]

In the October 21, 2026 LiteLLM compromise, JFrog Security Research compared malicious release wheels with the source archive and found payload files absent from the archive. Its report established artifact differences while explicitly leaving the compromise path unresolved. LiteLLM's October 23 canonical account later described exposed credentials and release approvals, correcting some early assumptions in its own incident updates. The later maintainer investigation and JFrog's initial artifact analysis establish different parts of the incident. [2][3]