NOW GENERALLY AVAILABLE

Enforcement that keeps up with the threat landscape: Continuous risk detection and policy management

Risk detection and policy management work as one loop, right where your packages live. New vulnerabilities and malicious packages don't wait for your next scan. We continuously ingest newly published advisories and match them against packages already in your workspace. Those matches feed straight into the web app, API, and policy management, so the policies you've set can act on new risks automatically. One control point covers every developer, pipeline, and AI coding tool pulling from your repository: detection that never goes stale, and policies that are automatically enforced and tailored to your specific security and compliance requirements.

Continuous risk detection

Broader risk intelligence: Continuous risk detection uses intelligence from the Open Source Vulnerabilities (OSV.dev) project, initiated by Google, to surface security and compliance issues in your repositories before they reach builds, downloads, or downstream consumers. It covers 29 distinct ecosystems, aggregating advisories from GitHub Advisory Database, OpenSSF Malicious Packages Project, National Vulnerability Database (NVD), and 18 other data sources. Continuous risk detection includes EPSS scores as well, so you can prioritize by real-world exploit probability, not just severity.

Automatically check for risks: Continuous risk detection automatically matches supported package formats against known vulnerabilities and malicious packages records at upload and continuously thereafter. Matches occur based on new or updated security information.

A new UI and API experience for continuous risk detection: Package risk data can be accessed in the Cloudsmith web app, queried through the Cloudsmith API, or used to automate quarantine, tag, or delete actions with policies. 

Policy management

Policy management with policy as code is now generally available: Start from our template library covering CVEs, malicious packages, licenses, and deny lists or build custom Rego policies for your specific security and compliance requirements. Either way, you have a policy engine that can grow with you as your policy position becomes more sophisticated or complex.

Cooldown policies, that don't break your builds: Hold newly published package versions until they clear a minimum age, closing the window most novel-package attacks rely on. It can apply to packages directly from upstream sources, as well as packages that are cached in your Cloudsmith workspace. Supported across go, Maven, npm, NuGet, and Python. 

Automatic resolution to the latest compliant version: When a policy blocks a package, the 403 now carries the policy name, description, and ID straight to the native client – developers see exactly what stopped them. Add your own guidance to the policy description, like a contact or a link to internal docs, and it travels with every block. Cooldown policies go further: if the requested version doesn't pass, package managers resolve to the latest compliant version instead of failing.

JULY 2026

Also new in Cloudsmith

📸 One tab to add Docker Hardened Images, Chainguard Containers, and WizOS as upstreams

The new Hardened Images tab quick-configures Docker Hardened Images (DHI), Chainguard Containers, and WizOS as upstreams — no more copying repository URLs or picking formats manually. Hardened image pulls are then proxied and cached like any other upstream, with the same access controls and pull history as the rest of your packages. 

🐜 A stronger bug bounty program means faster fixes to the platform

External security researchers have long helped Cloudsmith identify and fix vulnerabilities before they affect customers. Our refreshed bug bounty program, now live at bounties.cloudsmith.com, makes it faster and more transparent to submit reports, with rewards paid once we confirm validity. More researchers participating means more issues found and resolved before they can impact customers.

INDUSTRY ROUND UP 

Resources we think you'll love

🎥 Webinar | Inside the open source malware attack landscape | August 13, 4pm BST OpenSourceMalware founder Jenn Gile joins Cloudsmith's Head of Developer Relations Nigel Douglas, to walk through what the OpenSourceMalware community is tracking right now, including compromised GitHub repos linked to North Korea, evasion techniques evolving inside npm packages, and a growing wave of malicious VS Code extensions.  Register here →

⚠️ Blog | Inside the AsyncAPI npm supply chain attack On July 14, an attacker hijacked AsyncAPI's own CI/CD pipeline to publish four trojanized npm packages under the trusted @asyncapi namespace – 2.9M weekly downloads reached before most people noticed. The post-mortem explains why conventional defenses missed it and what a governed control layer catches. Read more →

☸️ Blog | Kubernetes 1.37: What you need to know Kubernetes 1.37 launches in August 2026. Cloudsmith's breakdown covers what's changing across networking, scheduling, DRA, and SIG-apps, and what platform teams need to know before the upgrade. Read more →

🧯Blog | How to use Cloudsmith as a dependency firewall Most security tools evaluate packages after they enter your environment. Cloudsmith governs what's allowed in before a build runs and checks everything in your repositories when new threat intelligence drops. No team has to configure its own pipeline rules to get that coverage. This guide covers upstreams, continuous enrichment, & an OPA-backed policy engine, from initial configuration through to enforcement. Read more →