ArtiFacts is your monthly roundup of new Cloudsmith product releases, industry news, and helpful resources.

NEW

Cooldown policies that work for developers, too

Cooldown policies let teams set a minimum age on OSS packages before they enter builds – a simple, low-friction way to reduce exposure to supply chain attacks like the recent Mini Shai-Hulud campaign.

Cloudsmith’s policy engine now filters non-compliant versions out of your repository index before package managers see them. That means no build failures, no retries – just clean resolution to the first version that meets your policy, automatically. 

This feature is in Early Access for Ultra and Enterprise customers, with support for Python and npm.

PRODUCT UPDATES 

What's new in Cloudsmith

🚨 Migrate from Cloudsmith CLI Action v1 to v2 before 31st December 2026

CLI Action v1 is now deprecated. With Node.js 20 having reached end-of-life, staying on v1 exposes pipelines to unpatched CVEs and potential Github Actions failures as Node 20 is phased out from hosted runners. Migrating to v2 is a one-line change. Read the migration guide. 

📏 Version range evaluation is now stricter and more predictable

This change resolves edge cases where a query like >=1.0 could incorrectly match prerelease versions, such as 1.0-a1. If you have existing version ranges configured in policies or entitlements, it's worth reviewing them to ensure they behave as expected under the updated logic.

INDUSTRY ROUND UP 

Resources we think you'll love

🚩 Workshop | Capture the Flag: Hunt the malicious package | June 18, 4pm BST
A malicious package is buried in Frontier Stack Inc.'s codebase. Join Cloudsmith, Chainguard, and Mend.io for a live, hands-on CTF – hunt the package, learn the upstream controls that keep it out of your build. Save your spot →

🎥 On-demand webinar | How platform engineering unlocks CRA readiness
Hosted by Platform Engineering, Nigel Douglas, Cloudsmith’s Head of Developer Relations, walked through embedding SBOM generation and CVE scanning into CI/CD before EU CRA enforcement begins in September. Watch on demand →

⚠️ Blog | TanStack npm packages compromised in Mini Shai-Hulud attack
Socket detected 84 compromised TanStack npm artifacts across 42 packages on May 12 – one of which (@tanstack/react-router) has 12M weekly downloads. The packages were caught minutes after publication. A cooldown policy in Cloudsmith would have reduced this exposure window – and malicious package detection via OSV advisories would have caught it automatically. Read more →