--- title: JFrog Names Nine Global Winners for Inaugural Software... description: JFrog has announced the nine winners of its first Software Supply Chain Excellence Awards, spanning the Americas, Europe and Asia-Pacific across three... canonical: https://daily.dev/posts/jfrog-names-nine-global-winners-for-inaugural-software-supply-chain-excellence-awards-78kre5vlp twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: JFrog Names Nine Global Winners for Inaugural Software Supply Chain Excellence Awards | daily.dev og:description: JFrog has announced the nine winners of its first Software Supply Chain Excellence Awards, spanning the Americas, Europe and Asia-Pacific across three... og:url: https://daily.dev/posts/jfrog-names-nine-global-winners-for-inaugural-software-supply-chain-excellence-awards-78kre5vlp og:image: https://api.daily.dev/og/posts/78Kre5vLP.png og:image:alt: JFrog Names Nine Global Winners for Inaugural Software Supply Chain Excellence Awards og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # JFrog Names Nine Global Winners for Inaugural Software Supply Chain Excellence Awards **[JFrog](https://daily.dev/sources/jfrog)** · 8 min read · 0 upvotes · 0 comments ## Summary JFrog has announced the nine winners of its first Software Supply Chain Excellence Awards, spanning the Americas, Europe and Asia-Pacific across three categories: Unified Platform, Trusted AI Adoption and Software Supply Chain Security. Winners include Ford, which now manages more than 43 million artifacts on the JFrog Platform and says it recaptured $8 million a year in developer productivity. S&P Global cut critical vulnerabilities across 30 images by 90%, from 141 to 14, and reports that about 99% of malicious npm and PyPI packages are blocked at ingestion. Iress says curation mitigated six critical security incidents in eight months and saved an estimated 13,705 engineering hours for the year. JFrog also cites its 2026 Software Supply Chain Security report finding over 900 malicious AI agent skills and 495 malicious AI models on Hugging Face. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### How many malicious AI models and agent skills has JFrog found in public registries? JFrog's 2026 Software Supply Chain Security report identified over 900 malicious AI agent skills carrying high-impact payloads, 495 malicious AI models on Hugging Face, and 56 malicious extensions on OpenVSX. The findings point to attackers increasingly targeting the autonomous tools that write, review, and deploy code, not just the code itself. _developers vetting AI models and extensions can track supply chain threat research like this on daily.dev._ ### What results has JFrog Curation delivered for blocking malicious open-source packages at large companies? S&P Global reports blocking about 99% of malicious npm and PyPI packages at the point of ingestion using JFrog Curation as a synchronous gate across its five divisions, cutting critical vulnerabilities across 30 images by 90%, from 141 to 14. Singapore Airlines separately reported late-stage release blocks from non-compliant dependencies down 60-75%. _teams evaluating dependency curation tools can compare real-world adoption numbers like these on daily.dev._ ## Similar posts on daily.dev - [JFrog Software Supply Chain Excellence Awards Launched](https://daily.dev/posts/jfrog-software-supply-chain-excellence-awards-launched-gn0vrgp7d) · JFrog · 0 upvotes · 0 comments - [JFrog report recaps a tumultuous year in supply chain security](https://daily.dev/posts/jfrog-report-recaps-a-tumultuous-year-in-supply-chain-security-omhn46ldt) · The New Stack · 0 upvotes · 0 comments - [JFrog Unveils “Shadow AI Detection” to Tackle Hidden AI Risks in Enterprise Software Supply Chains](https://daily.dev/posts/jfrog-unveils-shadow-ai-detection-to-tackle-hidden-ai-risks-in-enterprise-software-supply-chains-muf1pfhku) · InfoQ · 0 upvotes · 0 comments - [The Governance Gap Between Your Policy and Your Pipeline](https://daily.dev/posts/the-governance-gap-between-your-policy-and-your-pipeline-sggyudheo) · JFrog · 0 upvotes · 0 comments --- Tags: [#ai-security](https://daily.dev/tags/ai-security), [#devsecops](https://daily.dev/tags/devsecops), [#jfrog](https://daily.dev/tags/jfrog) [View this post on daily.dev](https://daily.dev/posts/jfrog-names-nine-global-winners-for-inaugural-software-supply-chain-excellence-awards-78kre5vlp) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"JFrog Names Nine Global Winners for Inaugural Software Supply Chain Excellence Awards","url":"https://daily.dev/posts/jfrog-names-nine-global-winners-for-inaugural-software-supply-chain-excellence-awards-78kre5vlp","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/jfrog-names-nine-global-winners-for-inaugural-software-supply-chain-excellence-awards-78kre5vlp"},"datePublished":"2026-10-28T14:31:42.037Z","dateModified":"2026-10-28T14:59:52.798Z","description":"JFrog has announced the nine winners of its first Software Supply Chain Excellence Awards, spanning the Americas, Europe and Asia-Pacific across three...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/9c58bdf50b1ab42558cdd70226b62563?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/9c58bdf50b1ab42558cdd70226b62563?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"JFrog","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"JFrog","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/b11bf37102384ac9983be701b2cf7cd5","url":"https://daily.dev/sources/jfrog"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/jfrog-names-nine-global-winners-for-inaugural-software-supply-chain-excellence-awards-78kre5vlp","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"ai-security,devsecops,jfrog","timeRequired":"PT8M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"JFrog","item":"https://daily.dev/sources/jfrog"},{"@type":"ListItem","position":3,"name":"JFrog Names Nine Global Winners for Inaugural Software Supply Chain Excellence Awards"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/jfrog-names-nine-global-winners-for-inaugural-software-supply-chain-excellence-awards-78kre5vlp#faq","mainEntity":[{"@type":"Question","name":"How many malicious AI models and agent skills has JFrog found in public registries?","acceptedAnswer":{"@type":"Answer","text":"JFrog's 2026 Software Supply Chain Security report identified over 900 malicious AI agent skills carrying high-impact payloads, 495 malicious AI models on Hugging Face, and 56 malicious extensions on OpenVSX. The findings point to attackers increasingly targeting the autonomous tools that write, review, and deploy code, not just the code itself. developers vetting AI models and extensions can track supply chain threat research like this on daily.dev."}},{"@type":"Question","name":"What results has JFrog Curation delivered for blocking malicious open-source packages at large companies?","acceptedAnswer":{"@type":"Answer","text":"S\u0026P Global reports blocking about 99% of malicious npm and PyPI packages at the point of ingestion using JFrog Curation as a synchronous gate across its five divisions, cutting critical vulnerabilities across 30 images by 90%, from 141 to 14. Singapore Airlines separately reported late-stage release blocks from non-compliant dependencies down 60-75%. teams evaluating dependency curation tools can compare real-world adoption numbers like these on daily.dev."}}]} ```