Cloudsmith Blog
Latest articles and insights
- Website
- cloudsmith.com · all feeds from this site
- Feed URL
https://cloudsmith.com/blog/rss
Read it in your FeedListing reader
Or add to: Feedly Inoreader Raw feed
Latest posts
-
Secure the packages AI agents install on their own
Teams that review agent-written code often skip the packages those agents install along the way. Learn how continuous risk detection, registry routing, and human-only exceptions close that gap.
-
13 KubeCon North America 2026 sessions not to miss
Heading to KubeCon North America 2026 in Salt Lake City? We've picked 13 sessions platform, DevOps and security teams won't want to miss, from attestation-driven admission at AT&T to packaging AI agents as OCI artifacts. Plus, find Cloudsmith at Booth 175, November 9–12.
- Critical PHP vulnerabilities in PHP2Shell expose web infrastructure to remote code execution
- LiteLLM 1.107.0 compromised on PyPI
- 20 October 2026: eMudhra intermediate CA certificates
-
10 GitHub Universe 2026 sessions not to miss
Heading to GitHub Universe 2026 in San Francisco? We’ve picked 10 sessions platform, DevOps and security teams won’t want to miss, from what really happens when you run npm install to guardrails for AI agents. Plus, find Cloudsmith in the Festival Pavilion, October 28–29.
-
Why enforce supply chain security at the artifact registry
Security teams cannot review every dependency, and AI agents add more of them each day. Enforcing policy at the artifact registry gives teams a single control point that covers developer workstations, CI builds, and production.
-
Tensorlake SDK npm package compromised
Tensorlake SDK 0.5.144 ran a worm on install that stole npm, GitHub, and cloud credentials along with AI coding tool configs. Learn how to check your lockfiles, which credentials to rotate, and how Cloudsmith policies stop releases like this from reaching your builds.
-
OIDC removed long-lived credentials from your pipelines. What about your laptop?
Five commands give your workstation the same short-lived, identity-based access your CI pipelines already use. Learn how Cloudsmith credential helpers supply tokens to Docker, pnpm, Cargo, and Terraform on request.
-
Cloudsmith expands support to Nix
Nix packages often sit outside the access controls and audit logs that cover the rest of the software supply chain. Cloudsmith brings them into the same workspace as 30+ other formats.
-
Everything Cloudsmith shipped in Q3 2026
Cloudsmith published 25 changelog entries in Q3 2026, covering Rego policy enforcement, hardened image upstreams, Nix support, per-package audit logs, and SCIM group provisioning. This roundup organizes every release by platform area so you can find the updates relevant to your…
-
How continuous risk detection replaces point-in-time scans with real-time monitoring
Scanning checks packages one at a time on a schedule, so results go stale the moment a new CVE lands. Matching flips that process, checking new threat data against packages already in the registry in near real time.
-
How Cloudsmith security features work: policy, risk detection, and the audit trail
Scanners flag risk after the fact, and pipeline gates only block or allow at a single point in time. Cloudsmith's security features enforce policy at the moment a package enters your registry and logs every decision along the way.
-
Simplify repository structure with connected repositories
Running dozens of upstream repositories takes real maintenance work, and each new endpoint also widens the attack surface teams have to secure. Connected repositories consolidate that sprawl into a prioritized resolution path.
- Trust your software supply chain from ingestion to production
-
Keyv and Cacheable npm packages compromised in active supply-chain attack
On August 4, 2026, a self-propagating worm began publishing malicious versions of the npm packages keyv and cacheable and their common dependencies. This keyv/cacheable supply-chain attack, tracked as keyv-shai-hulud, is still developing as we publish, and the list of affected…