JFrog report recaps a tumultuous year in supply chain security

JFrog says software supply chain risk surged in 2025 as package volumes hit record highs and malicious npm activity increased.

The report says AI models and agentic development tools are widening exposure across developer workflows, not just traditional code dependencies.

Attackers are moving faster than current governance and security controls can keep up, raising enterprise risk across modern application stacks.

JFrog highlights growing pressure on teams to improve software supply chain security, AI governance, and dependency oversight.