# Cloudsmith Blog

## 10 GitHub Universe 2026 sessions not to miss
Heading to GitHub Universe 2026 in San Francisco? We’ve picked 10 sessions platform, DevOps and security teams won’t want to miss, from what really happens when you run npm install to guardrails for AI agents. Plus, find Cloudsmith in the Festival Pavilion, October 28–29…

## Everything Cloudsmith shipped in Q3 2026
Cloudsmith published 25 changelog entries in Q3 2026, covering Rego policy enforcement, hardened image upstreams, Nix support, per-package audit logs, and SCIM group provisioning. This roundup organizes every release by platform area so you can find the updates relevant to your pipelines…

## How continuous risk detection replaces point-in-time scans with real-time monitoring
Scanning checks packages one at a time on a schedule, so results go stale the moment a new CVE lands. Matching flips that process, checking new threat data against packages already in the registry in near real time…

## 20 October 2026: eMudhra intermediate CA certificates

## Why enforce supply chain security at the artifact registry

## Tensorlake SDK npm package compromised

## Cloud Native Digest - July 2026

## How to use Cloudsmith as a dependency firewall

## Cloud Native Digest - June 2026

## OIDC removed long-lived credentials from your pipelines. What about your laptop?

## Cloudsmith expands support to Nix

## How Cloudsmith security features work: policy, risk detection, and the audit trail

## Simplify repository structure with connected repositories

## Trust your software supply chain from ingestion to production

## Keyv and Cacheable npm packages compromised in active supply-chain attack