JFrog Report Warns of Rising Security Threats

Highlights:

• Key threats to software supply chain security include CVEs, malicious packages, exposed secrets, and misconfigurations.
• The proliferation of AI and machine learning models, along with attacks, was found to be increasing.

A recent JFrog report warns of rising security threats in software supply chain. The growing adoption of AI technology in the software supply chain has led to a concerning increase in cybersecurity threats.

The finding is part of JFrog’s 2025 Software Supply Chain State of the Union, released in conjunction with the KubeCon CloudNativeCon Europe conferences. The report highlights emerging software security threats, evolving DevOps risks, best practices, and growing security concerns in the AI era.

Key findings in the report reveal that a “quad-fecta” of security vulnerabilities is jeopardizing the software supply chain. The main security threats to the integrity and safety of the supply chain include Common Vulnerabilities and Exposures, malicious packages, exposed secrets, and misconfigurations or other human errors.

The report highlights an example from the JFrog Security Research Team, which discovered 25,229 exposed secrets or tokens in public registries—a 64% increase year-over-year—with 27% still active. The growing complexity and interconnectivity of software security threats make it increasingly challenging for organizations to maintain consistent software supply chain security.

The report found a rise in AI and machine learning model proliferation and attacks. In 2024, over 1 million new models and datasets were added to Hugging Face, the largest public machine learning repository, alongside a 6.5-fold increase in malicious models.

While publicly uploaded models pose growing risks, organizations manually governing machine learning models also contribute to security concerns. About 94% of organizations maintain certified lists of approved models to regulate developer use, yet 37% still rely on manual curation, raising concerns about the accuracy and consistency of model security.

Binary scanning, which analyzes compiled software for vulnerabilities and malicious code undetectable in source code, remains underutilized. Only 43% of IT professionals reported that their organizations conduct security scans at both the code and binary levels, leaving many exposed to threats detectable only in binaries. This marks a decline from 56% in 2023, suggesting that despite rising risks, fundamental security measures like binary scanning are being overlooked or deprioritized.

The report also highlights ongoing challenges with open-source security. Over 70% of developers still download packages directly from public registries—a risky practice that can compromise entire organizations through a single vulnerable machine. Additionally, critical software vulnerabilities are increasing, with more than 33,000 new CVEs reported in 2024, a 27% rise from the previous year.