Not sure about jfrog, but Sonatype does something similar. They basically hash all components/packages from a bunch of different repositories, and then tag the hash with various metadata you can use to create policies.

I started using this in my org a couple years back, and we've ended up using it to check commercial software as well just to get an overview of known components, vulnerabilities and things to watch out for.

I really wish the big repositories would invest more in useful mechanisms; when we looked into this before making our decision, the only repository with any kind of checking was Maven Central. Nuget had support for author signing and repository signing, and Pypi (at the time) author signing. As far as I remember none of the other repositories had any verification of anything including the git repo, so you couldn't even determine what commit hash the code was based on or who was behind it.