Supply chain security | Cloudsmith
New research: Dependency attacks 2026
Supply chain security
How continuous risk detection replaces point-in-time scans with real-time monitoring
Scanning checks packages one at a time on a schedule, so results go stale the moment a new CVE lands. Matching flips that process, checking new threat data against packages already in the registry in near real time...
Keyv and Cacheable npm packages compromised in active supply-chain attack
On August 4, 2026, a self-propagating worm began publishing malicious versions of the npm packages keyv and cacheable and their common dependencies. This keyv/cacheable supply-chain attack, tracked as keyv-shai-hulud, is still developing as we publish, and the list of affected npm packages has grown through the day. Below we cover what we know so far, how to check whether your organization is exposed, and the controls that stop this class of attack from reaching your builds...
How to configure time for cooldown policies
Understand how configuring time-based cooldown controls on the client-side can become a security headache...