JFrog moves Xray's download blocking into a separately priced Curation seat by November 2026

Under the deprecation, Xray keeps scanning and flagging vulnerabilities and loses the power to act on what it finds ^[10]. The part that actually stops a bad package is one feature inside the product, and that feature is the one being retired ^[9].

The case for gating sits in this year's npm record. Malicious versions of axios were published directly to npm in March 2026 ^[3]. In May, attackers forged valid provenance for 42 TanStack packages and shipped 84 malicious versions before detection, an average of two bad versions per package, each carrying provenance that validated ^[4][19]. By August a worm was using one maintainer's stolen credentials to propagate through keyv and the packages that depend on it ^[5]. Account takeovers and self-propagating worms already move faster than catalog updates or ticket queues, the devops.com piece argues, and the next wave of consumers pulling those packages is autonomous agents installing dependencies with no human in the loop ^[17][18].

What you are actually buying comes down to who writes the policy and where the decision runs. In JFrog Curation, policy lives inside JFrog's own catalog and UI ^[13]. Cloudsmith lets customers write policy as Rego, which the article calls "genuine policy-as-code", with the code executing inside Cloudsmith's hosted platform, and neither vendor lets you take the policy elsewhere ^[14][22]. Socket, Sonatype's Firewall Pro and Veracode's Package Firewall will front whatever registry you already run with no platform migration, and each calls out to a SaaS API before a build can proceed ^[15]. Every option named in the article executes in a vendor's cloud; the difference is who writes the rule ^[21]. Ask each of them what an API timeout does to a build at 2am.

On the developer's machine, the default has already flipped. npm 12 disabled dependency install scripts outright, closing what the article says GitHub called the single largest code-execution surface in the npm ecosystem ^[1][2]. A dependency that relied on a script at install time no longer runs it unless someone overrides the default ^[26], and the article does not list which packages stop working.

Write down what your gate blocks today, then check which of those blocks still exists after November 2026. That is about eight months from the start of the deprecation window ^[20]. Then price the replacement: Curation is licensed and priced on its own, per seat, and evaluates a package's metadata, including its age and publisher, before the download ^[11]. Per-seat pricing tracks developer headcount, and after an acquisition it is common to find Artifactory in one business unit, Azure Artifacts or Nexus in another and GitHub Packages somewhere else again ^[16].