JFrog Curation alternatives

Questions and answers

What does JFrog Curation do?

JFrog Curation is a policy gate, offered by JFrog in the JFrog Platform, that blocks open-source packages before Artifactory serves them to developers or builds. JFrog Curation checks each package as the package comes in through Artifactory and blocks the ones that fail your policy, so a package that breaks policy never reaches a laptop or a CI job that installs through Artifactory. In practice, a developer whose npm client points at Artifactory receives only the versions that passed the JFrog Curation policy. For an organisation that already runs Artifactory, Curation adds install-time blocking to infrastructure the team already operates, and teams that use JFrog Xray keep one vendor and one console. Curation’s decision logic is closed source. For installs that skip the Artifactory URL, ask JFrog how a developer’s direct registry URL is detected and closed.

When is JFrog Curation the right choice?

• You already run Artifactory and want blocking without adding another component.
• Your teams already use JFrog Xray, and you want one vendor and one console.
• Your procurement team prefers adding a module to an existing contract over onboarding a new vendor.

If that describes you, Curation is a reasonable choice, and the comparison below may not change your mind.

Why look for an alternative?

The usual reason to look for a JFrog Curation alternative is that JFrog Curation works through Artifactory, and not every team runs Artifactory or wants every install to pass through Artifactory: a team that installs straight from npm and PyPI would first have to adopt Artifactory to use Curation. Teams that look elsewhere usually name one of four reasons:

1. They do not run Artifactory, or do not want to make Artifactory the path every install takes.
2. They want to read the code that makes the block decision before routing the organisation’s installs through it. JFrog Curation is closed source.
3. They need the block enforced on laptops, CI and the network, not only for installs that happen to use the registry URL.
4. They need to run the control fully air-gapped with their own update process.

What are the alternatives to JFrog Curation?

The main alternatives to JFrog Curation are Chainsaw, Sonatype Repository Firewall, Socket and CLI wrappers, for example Aikido Safe Chain and Datadog’s Supply-Chain Firewall. The alternatives differ mostly in where the check sits. Chainsaw is a registry proxy in front of any registry, or the registry itself, with an open-source decision engine. Sonatype Repository Firewall sits in front of Nexus Repository, or self-hosted Artifactory through a plugin. Socket works through its own tooling and integrations, with deep behavioural analysis on npm. A CLI wrapper is free and quick to try on one developer’s machine, but a CLI wrapper is not an organisation-wide control.

Alternative	Where it sits	Notes
Chainsaw	A registry proxy in front of any registry, or as the registry	Open-source decision engine; SaaS, VPC, self-hosted or air-gapped from one binary
Sonatype Repository Firewall	In front of Nexus Repository, or self-hosted Artifactory through a plugin	The natural choice for Nexus shops
Socket	Its own tooling and integrations	Deep behavioural analysis on npm; SaaS-first. Socket vs Chainsaw
CLI wrappers (Aikido Safe Chain, Datadog’s Supply-Chain Firewall)	On one developer’s machine	Free and quick to try; not an organisation-wide control

How is Chainsaw different from JFrog Curation?

Do you need Artifactory?

JFrog Curation: Yes. JFrog Curation is part of the JFrog Platform and works through Artifactory.

Chainsaw: No. Chainsaw is a registry proxy that package managers and CI pull through, so Chainsaw proxies the public registries directly, after a one-line registry URL change per package manager. An npm team first changes the registry line in .npmrc and keeps the rest of the build as it is. Chainsaw covers 16 ecosystems, including npm, PyPI, Maven, Go, Cargo and Docker. On npm and PyPI the same URL also serves packages you publish to Chainsaw, when no public package has that name; other formats use a separate hosted repository. If you keep Artifactory, Chainsaw can sit in front of Artifactory, or Chainsaw can be the registry itself. How that coexistence works.

Can you read the decision logic?

JFrog Curation: No. JFrog Curation is closed source.

Chainsaw: Yes. The Chainsaw decision engine, the code that decides whether a package is refused, is open source under Apache-2.0 at github.com/chain305/chainsaw-core and ships as the Chainsaw CLI. A security team can read the rule that refused a package before routing the first install through Chainsaw. A developer can run the same engine locally with no account: for example, the CLI guard hooks npm, pip, cargo, gem and go in the shell and refuses known-malicious packages and typosquats before they download. The hosted product, with the dashboard, policy, intelligence, SSO/SCIM and audit, is not open source.

What stops installs going around it?

JFrog Curation: Check with JFrog how a developer’s direct registry URL is detected and closed.

Chainsaw: Chainsaw closes the bypass at CI, on laptops and at the network, because a package firewall only protects installs that go through the firewall. First, a CI gate fails builds that pulled packages from anywhere other than the Chainsaw proxy. For example, a pipeline step that runs pip install against the public PyPI URL fails the build instead of shipping an unchecked dependency. MDM settings pin developer laptops to the proxy URL. Egress rules block direct traffic to public registries. Chainsaw then reports an attestation of whether the gap is closed.

How does a rollout start?

Chainsaw: Monitor mode is the starting point for every Chainsaw rule except five seeded rules that block from day one. In monitor mode Chainsaw records what each rule would refuse on your own dependencies without refusing anything, so no install breaks while the team reviews the results. The five seeded rules cover CISA KEV, packages under 1 day old, install scripts fetching remote URLs, import-time execution and bidi Unicode. Every other rule moves to enforce one rule at a time. Most teams first run Chainsaw in monitor mode next to the existing tool for a week, compare what each rule would have refused, then enforce the rules they trust. During that week, JFrog Curation can keep blocking while Chainsaw records its decisions on the same installs.

What does it look at beyond CVEs?

Chainsaw: Chainsaw’s check beyond CVEs is a set of 25 supply-chain detection signals, plus a default 48-hour release hold. Chainsaw runs up to all 25 on npm and PyPI (2 opt-in), 22 on RubyGems, and at least 4 on every proxied ecosystem. The signals include install-script exfiltration, maintainer-account takeover, version anomalies, hidden Unicode, publish-velocity worm bursts and more. The release hold works by format: npm, PyPI and Composer hide versions younger than 48 hours, so version ranges resolve to an older version, and 17 other formats refuse an exact pin to a too-new version. Install-script and import-time checks run on the first download, so an install script that fetches a remote URL is refused by a seeded rule from day one, before any advisory exists. The full list.

How do you test an alternative without risk?

The low-risk test is to run Chainsaw in monitor mode next to JFrog Curation for a week. In monitor mode Chainsaw records what each rule would have refused without refusing anything, so installs keep working and Curation keeps blocking as before. After a week, compare Chainsaw’s decisions with Curation’s on your own dependencies, then move one Chainsaw rule at a time to enforce. Chainsaw can sit in front of Artifactory for the test, so both see the same installs. The free Chainsaw CLI runs locally with no account, and hosted Chainsaw is free for 3 people, so the test needs no purchase.