Skip to content

Back to the catalog

JFrog: The Governance Gap Between Your Policy and Your Pipeline
jfrog.comarticle

JFrog: The Governance Gap Between Your Policy and Your Pipeline

JFrog previews its 2026 Software Supply Chain Security State of the Union report, drawing on 18.2 billion analyzed artifacts and a 1,508-person survey to describe an "illusion of mastery" gap between claimed governance and actual pipeline enforcement. It cites specific findings: 495 malicious models found on Hugging Face despite 97% of orgs claiming certified AI model governance, 171,592 malicious npm packages detected in 2025 (up 451%) with malicious-package detection flat at 40%, 96% of NVD-Critical CVEs downgraded on real-world exploitability, only 28% of orgs running secrets detection despite 17,637 exposed tokens found (3,260 still active), a CVSS 9.6 RCE in mcp-remote, 56 malicious OpenVSX IDE extensions, and references to the GlassWorm and s1ngularity supply-chain attacks.

TL;DR JFrog's 2026 supply-chain report teaser quantifies the gap between claimed AI/package governance and actual enforcement, citing malicious Hugging Face models, a 451% npm malware spike, and an mcp-remote RCE.
Open original ↗

Technologies named here

Techniques named here

  • Malicious model/package publishing
  • Credential harvesting via compromised extensions
  • Remote access trojan deployment
  • Secrets leakage via misconfigured CI/CD workflow
  • Exposed token harvesting in binary repositories
  • Weaponization of IDE extensions and MCP servers

Threat actors named here

  • GlassWorm attack
  • S1ngularity campaign
  • Malicious Hugging Face models
  • Malicious npm packages
  • Malicious IDE extensions on OpenVSX
  • GlassWorm
  • s1ngularity

Related in Supply Chain