Enforce trust across your software supply chain.

Block malicious dependencies, define guardrails for what’s allowed, and enforce policies automatically as AI-assisted development introduces dependencies faster than ever.

Today's reality

Software assembly has gotten faster, more automated, and harder to manually review. The controls most teams rely on weren't built for this.

Detection isn’t enough. Teams need enforcement.

Most security controls evaluate software at a specific point in the pipeline: a PR check, a CI scan, a post-deploy audit. These points matter, but gaps remain. Not every pipeline is configured the same way and enforcement isn’t always consistent.

Point-in-time evaluation has a shelf life.

A package that cleared ingestion this morning can be a liability by afternoon if new CVEs drop or threat intelligence changes.

AI has changed how fast dependencies get pulled.

Developers ship faster and pull more dependencies than ever. Some are chosen deliberately; others installed at the tool's suggestion without a review. The volume of software entering your environment has outpaced any team’s ability to manually evaluate it.

Cloudsmith is the control plane for your software supply chain.

Control every dependency in your environment and enforce policy directly at the artifact repository every developer, pipeline, and AI agent pulls from.

Policy management

Threat signals shift by the hour, faster than teams can manually respond. Policy management interprets them and automates the response.

• Apply cooldown policies to block newly published, untrusted packages
• Use industry standard OPA Rego to define software usage policies
• Apply policies from ingestion through production, to every package and container that flows through Cloudsmith
• Perform actions based on your policies
• Manage exemptions when a package needs to move forward outside standard policy

A newly published package can carry risk no one has reviewed yet. Cooldown policies hold it until it clears.

• Set a cooldown window that holds newly published packages until they clear policy checks
• Resolve automatically to the latest compliant version so builds succeed on the first try
• Enforce the cooldown at the repository, not in individual pipelines or client-side tooling
• Now supports npm, Python, Go, Maven, and NuGet, giving teams consistent protection across the ecosystems they rely on most

Outcomes

Dependencies can enter from anywhere, unverified. Control what enters your environment at a single trusted point.

• Proxy and cache all registries through Cloudsmith, serving every dependency from a single trusted source
• Set policy once and enforce it across every team, every pipeline, and every format.
• Stop vulnerabilities, malicious packages, and license violations before they move downstream
• Block dependency confusion attacks by defining trusted and untrusted sources

New threats surface faster than manual review can track. Stay current automatically.

• Cloudsmith continuously ingests the latest vulnerability and malicious package intelligence
• Checks your repository instantly when new records are published
• New threats automatically trigger policy evaluation to flag or block affected packages before they reach downstream teams.

Your AI agents can pull packages no one approved. Govern dependency selection by your AI agents just like you do your developers.

• Route every install, human or AI-driven, through one dependency firewall, leaving no separate path to govern
• Apply the same policies to agent and assistant pulls automatically, catching unsafe packages before use
• Enforce license policies at the repository, blocking incompatible licenses

Risk already in your environment can stay invisible for months. Use SBOM data to see it and act.

• Generate SBOMs for container images automatically
• Store and share SBOMs alongside the artifacts they describe
• Surface risk in components already in your environment as threat intelligence changes

Continuous risk detection

Packages are continuously re-evaluated against the latest advisories, surfacing newly disclosed risks automatically.

License reporting

Report on license types across repositories and organizations to support compliance management.

Policy-as-code

Define rules with OPA/Rego, enforced automatically across every pipeline.

Cooldown policies

Prevent newly published packages from being consumed until a configurable time window elapses.

Package quarantine

Prevent packages from being distributed to teams and pipelines when they fail policy checks.

Upstream trust

Stop trusted packages from being overridden by identically-named packages from untrusted sources.

SBOM management

Automatically generate SBOMs for container images including transitive dependencies and license metadata.

Custom signing keys

Ensure packages have not been tampered with by signing with your own custom encryption keys.

Powerful Features. Simple Control.

Frequently asked questions

1. How does Cloudsmith enforce policy before a package reaches my environment?

Cloudsmith policy management evaluates packages against defined criteria and takes automated action the moment a match is found, including at the repository index itself, before a package is ever pulled into your environment.

2. Can I write risk-tiered policies instead of a binary allow or block?

Yes. Policy as code is built on Open Policy Agent and Rego, so you can define precise, version-controlled rules for vulnerability severity, license compliance, and more, with exemptions when a package needs to move forward outside standard policy.

3. How does Cloudsmith catch newly published or malicious packages?

A cooldown policy holds newly published packages until they clear an age or review threshold, while continuous malicious package detection matches packages against threat intelligence in near real time, so risk is caught before it reaches downstream teams.

4. How do SBOMs help me see risk already in my environment?

Cloudsmith generates Software Bills of Materials for the artifacts in your workspace, listing components, licenses, and dependencies so you can trace exactly what each package contains and act as new threat intelligence surfaces risk already present.