JFrog Security Research

A company research team

JFrog Security Research is JFrog's security research team, rather than a separate software company. It publishes vulnerability and malicious-package investigations alongside work informing JFrog's security products. Its relevance to AI includes research on the libraries and release systems used by AI applications. [1][2]

Researcher Guy Korolevski's October 21 LiteLLM report described malicious startup hooks in all seven published version 1.107.0 wheels, with the payload files absent from the source tarball. The report cautioned that those observations did not prove which account, machine or build system had been compromised. LiteLLM's October 23 account subsequently traced the credential and approval chain. This separation keeps the team's demonstrated artifact findings distinct from later conclusions about how the release was published. [2][3]