--- updatedAt: 2026-08-19T07:48:55.000Z agentTools: siteIndex: https://docs.jfrog.com/llms.txt projectIndex: https://docs.jfrog.com/security/llms.txt --- # List of Available Conditions This table lists the available conditions in Curation: | Category | Condition | Description | Custom condition available | Relaxation Parameters | Supported Package Types | | ----------- | ----------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------ | ------------------------------------------- | | Security | Malicious package | Blocks 3rd party packages that the JFrog Security Research team has identified as malicious. | No | N/A | All | | Security | CVE with CVSS (all score combinations) | Blocks 3rd party package versions with a known CVE with NVD CVSS score (all combinations) | Yes | | All (except Docker) | | Security | OpenSSF | Block packages based on one or more scorecard checks. | Yes | Disregard if the score does not exist. | All (except Docker) | | Security | Package Vulnerable to CVE | Detects if the 3rd party package is vulnerable to the configured CVE ID | Yes | N/A | All (except Docker) | | Security | Block packages listed by Catalog labels | Blocks 3rd party packages that are on a blocked list | Yes | N/A | All (except Docker) | | Security | Allow only packages listed by Catalog labels | Blocks 3rd party any packages that are not on the allowed list | Yes | N/A | All (except Docker) | | Legal | Block list by License | Blocks 3rd party packages with any version that you define. Also evaluates [custom assigned licenses](https://docs.jfrog.com/security/docs/create-and-assign-custom-licenses) from JFrog Catalog. | Yes | Allow if one or more package licenses are not on the list. | All (except Docker) | | Legal | Allow list by License | Blocks 3rd party packages with any version that is not on the defined list. Also evaluates [custom assigned licenses](https://docs.jfrog.com/security/docs/create-and-assign-custom-licenses) from JFrog Catalog. | Yes | Allow if at least one package license is on the list. | All (except Docker) | | Legal | Package has no identified license | Blocks 3rd party package versions that have no identified license, either because it is missing or because it could not be identified as the package license. | No | N/A | All (except Docker) | | Operational | Image is not Docker Hub official | Detects Docker Images from the Docker Hub registry that do not have “Docker Official Image" | No | N/A | Docker | | Operational | Package version is aged (no newer version identified) | Blocks 3rd party package versions whose release date is more than 2 years old, and no newer version of the package exists. | No | N/A | All (except Docker) | | Operational | Package version is aged (newer version available) | Blocks 3rd party package versions whose release date is more than 180 days older than the package’s latest version release date. | No | N/A | All (except Docker) | | Operational | Package version is immature | Blocks 3rd party packages whose version release date is less than the defined number of dates old | Yes | Allow if fixes CVE in your repositories | All (except Docker) | | Operational | Package has only a single version | Blocks 3rd party packages that have only one version available, which are often immature or unmaintained. | No | N/A | All (except Docker) | | Operational | Package version is End of Life | Blocks 3rd party package versions that JFrog Catalog marks as End of Life (EOL). EOL versions no longer receive security patches or maintenance updates. Available from Xray 3.150.17. | No | N/A | npm, PyPI, NuGet, RubyGems, Composer, Cargo |