Cloudsmith Blog

10 GitHub Universe 2026 sessions not to miss

Heading to GitHub Universe 2026 in San Francisco? We’ve picked 10 sessions platform, DevOps and security teams won’t want to miss, from what really happens when you run npm install to guardrails for AI agents. Plus, find Cloudsmith in the Festival Pavilion, October 28–29…

Everything Cloudsmith shipped in Q3 2026

Cloudsmith published 25 changelog entries in Q3 2026, covering Rego policy enforcement, hardened image upstreams, Nix support, per-package audit logs, and SCIM group provisioning. This roundup organizes every release by platform area so you can find the updates relevant to your pipelines…

How continuous risk detection replaces point-in-time scans with real-time monitoring

Scanning checks packages one at a time on a schedule, so results go stale the moment a new CVE lands. Matching flips that process, checking new threat data against packages already in the registry in near real time…

20 October 2026: eMudhra intermediate CA certificates

Why enforce supply chain security at the artifact registry

Tensorlake SDK npm package compromised

Cloud Native Digest - July 2026

How to use Cloudsmith as a dependency firewall

Cloud Native Digest - June 2026

OIDC removed long-lived credentials from your pipelines. What about your laptop?

Cloudsmith expands support to Nix

How Cloudsmith security features work: policy, risk detection, and the audit trail

Simplify repository structure with connected repositories

Trust your software supply chain from ingestion to production

Keyv and Cacheable npm packages compromised in active supply-chain attack