safe-chain-jfrog-plugin: Turning Artifactory Into a Dependency Bouncer

Most dependency tools inspect what already landed. This repo changes the question. AikidoSec/safe-chain-jfrog-plugin treats Artifactory as a checkpoint, not a shelf, and it decides whether a package should enter before the bytes reach a developer or CI job.

The package never makes it past the door

That is the cleanest idea in the codebase. The plugin hooks the download path, looks at the request while it is still in transit, and can return a 403 before the artifact is served. In supply-chain security, that timing matters more than a bigger scan database.

Two Artifactory extension models, one policy

The repo has a split personality. One implementation lives in the classic JFrog user-plugin world, with Groovy at the edge and Java doing the decision work. The other lives in JFrog Workers, written in TypeScript, for teams that want the newer execution model.

How the veto actually happens

The mechanics are surprisingly small. The Groovy hook intercepts the download with an altResponse block, then hands the request to a handler that checks whether the repository is remote, whether the path looks like a package the plugin understands, and whether the package appears in Aikido’s malware feed.

download {
  altResponse {
    if (altResponseHandler.isMalicious(request)) {
      response.setStatus(403)
      response.setMessage('blocked by safe-chain')
    }
  }
}

The Worker mirrors the same idea in TypeScript, but with a different control posture. If the lookup fails, the catch path stops the download. That is a fail-closed design, which is exactly what you want when the check itself is part of the defense.

Why this block is stricter than it looks

The repo is narrower than a generic package scanner, and that restraint is useful. It ignores local repositories, focuses on remote ones, and today the Java path is effectively NPM-first even though the data model shows awareness of other ecosystems and normalization tricks.

• It filters for remote repositories, because that is where external supply-chain risk enters.
• It normalizes package names, which helps blunt typosquatting and naming tricks.
• It treats lookup failure as a stop condition in the Worker, not a silent pass-through.

What Aikido is really shipping

The repo is not trying to be a general artifact scanner. It is shipping a policy surface. Aikido’s broader Safe Chain message is simple, and this integration extends it into the registry layer: fetch live threat intel, apply a narrow set of rules, and decide before the package crosses the boundary.

That makes the project feel less like a feature add-on and more like an enforcement primitive. Once you care about the moment of admission, Artifactory stops being passive storage and starts acting like a guardrail.

How it stacks up

The real comparison is not feature count. It is where the decision lands. Some tools are built for scanning after ingestion, while this repo is built to block at the door.

The bigger lesson

The codebase is interesting because it reframes supply-chain defense as transport policy. Instead of asking whether a dependency can be cleaned up later, it asks whether the dependency should be allowed to arrive at all. That is a much harder line, and a much more honest one.