# agentsite-static-version=51dae4c0-5318-47f0-9360-1a7d6060c2c1
# cloudsmith.com

> AI-optimized mirror of cloudsmith.com containing 243 pages totalling 180,192 words of clean markdown content, structured data, and semantic HTML. Original source: https://cloudsmith.com. Last updated: 2026-10-22T09:00:41.589Z.

Each page is available as HTML (with JSON-LD structured data) and Markdown (text-only, ideal for LLMs and RAG).

## Homepage

- [Cloudsmith: Cloud-Native Artifact Management Platform](/content/site-root.html): The cloud-native alternative to JFrog Artifactory. Control, secure, and distribute every package and container at enterprise scale, fully managed. (758 words)

## Articles & Blog Posts

- [Securing LLM dependencies against serialisation attacks | Cloudsmith](/content/blog/securing-llm-dependencies-against-serialisation-attacks.html): Learn how to secure LLM supply chains against serialization attacks. This guide explores why Python’s Pickle format is inherently insecure, demonstrates vulnerability scanning with Picklescan and Modelscan, and shows how to use Cloudsmith Rego policies to automate the blocking of malicious Hugging Face models. (1,274 words)
- [Configure better cooldown policies for open source packages | Cloudsmith](/content/blog/how-to-configure-time-for-cooldown-policies/index.html): Securing polyglot environments is tough when npm, pnpm, Bun, and pip handle time differently. Learn how to fix package manager configuration drift and unify supply chain security with registry-side cooldown policies. (1,346 words)
- [Cloud-Based vs Cloud-Native: Key Differences & Benefits Explained | Cloudsmith](/content/blog/cloud-based-vs-cloud-native-whats-the-difference/index.html): Learn the difference between cloud-native and cloud-based, explore cloud-native platforms, apps, tools, and key benefits for modern development. (1,208 words)
- [The Evolution of Shai-Hulud Worm Attacks | Cloudsmith](/content/blog/evolution-of-shai-hulud-worms/index.html): A technical teardown of the 2026 Shai-Hulud worm campaign, including Mini Shai-Hulud, Miasma, and Hades variants targeting npm, PyPI, and CI pipelines. (2,335 words)
- [Policy Management with Cloudsmith](/content/blog/enterprise-policy-management-with-cloudsmith/index.html): Learn how Cloudsmith's policy management automates security, license, and compliance policies across your software supply chain using policy as code. (2,138 words)
- [Managing Malicious Packages with Cloudsmith EPM](/content/blog/managing-open-source-vulnerabilities-epm/index.html): Learn how Cloudsmith EPM uses OpenSSF's malicious package project to detect and block malware in open source packages. (812 words)
- [Why Security Teams Demand Package Cooldown Policies | Cloudsmith](/content/blog/your-upstream-is-not-your-friend-why-security-teams-are-demanding-package-cooldown-policies.html): Public registries carry no admission controls and no downstream notification obligations. Package cooldown policies hold new dependencies through a defined evaluation window before they reach the build environment. (2,205 words)
- [Why cloud migration is the best time to revisit artifact management | Cloudsmith](/content/blog/why-cloud-migrations-are-the-best-time-to-re-evaluate-your-artifact-management.html): Cloud migration is the perfect moment to modernize artifact management, reduce risk, and secure your software supply chain with a SaaS artifact repository. (1,172 words)
- [Continuous risk detection is now generally available | Cloudsmith](/content/changelog/continuous-risk-detection-is-now-generally-available.html): Every package in your workspace is now checked automatically against known vulnerabilities and malicious packages, with no scheduled or manual rescans required. This is powered by OSV.dev, which has driven policy evaluation since early access and now also replaces Trivy as the data source shown in the web app and API… (723 words)
- [Software supply chain attack | Cloudsmith](/content/resources/glossary/software-supply-chain-attack/index.html): A software supply chain attack is a cyberattack that targets an organization by compromising the third-party components, tools, or processes used to build and… (739 words)
- [LLMOps vs DevOps: Artifact management for LLMs | Cloudsmith](/content/blog/llmops-vs-devops-what-llmops-means-for-artifact-management.html): Learn how LLMOps differs from DevOps and why artifact management is critical for traceable, reproducible, and scalable LLM-powered applications. (943 words)
- [SIEM (Security Information and Event Management) | Cloudsmith](/content/resources/glossary/siem/index.html): Security Information and Event Management, or SIEM,  helps solve cybersecurity problems by aggregating and analyzing log data from across an organization’s entire digital… (620 words)
- [License compliance | Cloudsmith](/content/resources/glossary/license-compliance/index.html): License Compliance is the practice of ensuring that all software within an organization is used in accordance with its licensing terms, whether the software… (437 words)
- [How to Audit Your Software Supply Chain Security | Cloudsmith](/content/blog/how-to-audit-your-software-supply-chain-security/index.html): Guard your software supply chain security with this step-by-step process to audit the entire chain. (1,010 words)
- [Policy management is now generally available | Cloudsmith](/content/changelog/policy-management-is-now-generally-available/index.html): Following early access, policy management - Cloudsmith's policy-as-code system for enforcing rules across your software supply chain - is now generally available across the web app, API, and Terraform provider… (608 words)
- [Dependency confusion | Cloudsmith](/content/resources/glossary/dependency-confusion/index.html): Dependency confusion is an attack where a build installs a malicious public package instead of an internal package with the same name. It works… (404 words)
- [Datadog Integration Update: Vulnerability Scanning and Audit Logs | Cloudsmith](/content/blog/cloudsmith-in-datadog-update/index.html): The team at Cloudsmith is always looking for ways our customers and community can leverage adjacent technologies within the DevOps and application development ecosystem to secure the software supply c… (490 words)
- [Cooldown policy | Cloudsmith](/content/resources/glossary/cooldown-policy/index.html): A cooldown policy is a rule that holds newly published packages for a set period before they can be installed. It gives the community… (396 words)
- [Package signing | Cloudsmith](/content/resources/glossary/package-signing/index.html): Package Signing is the process of cryptographically signing software packages – such as libraries, installers, updates, or container images, so users can verify their… (442 words)
- [Software license compliance | Cloudsmith](/content/resources/glossary/software-license-compliance/index.html): Software License Compliance is the practice of ensuring that all software inside an organization from SaaS subscriptions to open-source libraries, is being used strictly… (446 words)
- [General public license | Cloudsmith](/content/resources/glossary/general-public-license/index.html): The General Public License (GPL) is one of the most widely known copyleft open-source licenses. Created by the Free Software Foundation, its purpose is… (446 words)
- [Policy as code | Cloudsmith](/content/resources/glossary/policy-as-code/index.html): Policy as code is the practice of writing security and compliance rules as versioned, machine-enforceable code. Instead of a document that people must remember,… (306 words)
- [Software supply chain security | Cloudsmith](/content/resources/glossary/software-supply-chain-security/index.html): Software Supply Chain Security is the practice of protecting every stage of the software lifecycle, from coding and dependency selection, through building, signing, distribution,… (519 words)
- [SBOM (Software Bill of Materials) | Cloudsmith](/content/resources/glossary/sbom/index.html): A Software Bill of Materials (SBOM) is a detailed inventory of every software component that comprises an application, including open-source libraries, third-party dependencies, frameworks,… (490 words)
- [Security scanning | Cloudsmith](/content/resources/glossary/security-scanning/index.html): Security Scanning is the process of automatically examining software, systems, code, and infrastructure to detect security vulnerabilities, misconfigurations, malware, and risky behavior before attackers… (381 words)
- [Copyleft | Cloudsmith](/content/resources/glossary/copyleft/index.html): Copyleft is a licensing principle used in some open-source software that allows users to freely use, modify, and distribute code, as long as any… (358 words)
- [CVE (Common Vulnerabilities and Exposures) | Cloudsmith](/content/resources/glossary/cve/index.html): A CVE is a standard identifier assigned to a publicly disclosed security vulnerability in software or hardware. Each identifier follows the pattern CVE, year,… (288 words)
- [Upstream proxy | Cloudsmith](/content/resources/glossary/upstream-proxy/index.html): An upstream proxy is a registry that fetches packages from an external source on demand and serves them to your builds. Think of it… (338 words)
- [Typosquatting | Cloudsmith](/content/resources/glossary/typosquatting/index.html): Typosquatting is publishing a malicious package with a name almost identical to a popular one, to catch mistyped or misremembered installs. A single swapped… (260 words)
- [Securing non-deterministic systems: A practical guide for AI artifacts and LLMOps | Cloudsmith](/content/campaigns/securing-non-deterministic-systems-a-practical-guide-for-ai-artifacts-and-llmops.html): A practical guide to securing non-deterministic systems in AI and LLMOps, covering AI-generated code, model supply chain risks, unsafe serialization, and artifact management. (228 words)
- [Trusted publishers | Cloudsmith](/content/resources/glossary/trusted-publishers/index.html): Trusted Publishers are verified organizations or developers who digitally sign and distribute software so users and systems can confirm the authenticity of the source.… (324 words)
- [GPG key | Cloudsmith](/content/resources/glossary/gpg-key/index.html): A GPG Key (GNU Privacy Guard Key) is a cryptographic key pair used for encryption and digital signatures. It allows users and systems to… (327 words)
- [Open source license | Cloudsmith](/content/resources/glossary/open-source-license/index.html): An Open Source License is a legal agreement that defines how open-source software may be used, modified, and distributed. It protects both developers and… (296 words)
- [Compliance | Cloudsmith](/content/resources/glossary/compliance/index.html): Compliance refers to following the laws, regulations, standards, and internal policies that apply to an organization. These rules may relate to data protection, financial… (326 words)
- [Dependency firewall | Cloudsmith](/content/resources/glossary/dependency-firewall/index.html): A dependency firewall is a control layer that decides which external packages may enter your environment before anyone can use them. It works like… (307 words)
- [Transitive dependency | Cloudsmith](/content/resources/glossary/transitive-dependency/index.html): A transitive dependency is a package your software needs indirectly because one of its direct dependencies requires it. If you add package A and… (289 words)
- [GitHub + Cloudsmith: Secure Your Software Supply Chain](/content/partners/github/index.html): Connect GitHub to Cloudsmith to publish build artifacts, enforce security policies, scan for vulnerabilities, and distribute trusted packages automatically. (351 words)
- [Code signing | Cloudsmith](/content/resources/glossary/code-signing/index.html): Code Signing is the process of digitally signing software so users can verify two key facts: (320 words)
- [Software Supply Chain Security: June 2026 Roundup | Cloudsmith](/content/blog/cloud-native-digest-june-2026/index.html): Discover the most impactful software supply chain security incidents and industry updates from June 2026. Nigel Douglas breaks down the developments across JavaScript, Python, PHP, Rust and more. (3,644 words)
- [Audit trail | Cloudsmith](/content/resources/glossary/audit-trail/index.html): An Audit Trail is a chronological, tamper-resistant record of actions taken within a system, such as user logins, configuration changes, approvals, or data access… (265 words)
- [ansi-regex (6.2.2) - npm Package Quality | Cloudsmith Navigator](/content/navigator/npm/ansi-regex/index.html): Learn all about the quality, security, and current maintenance status of ansi-regex using Cloudsmith Navigator (452 words)
- [Artifact provenance | Cloudsmith](/content/resources/glossary/artifact-provenance/index.html): Artifact provenance is verifiable information about where a software artifact came from and how it was built. It works like a chain of custody,… (278 words)
- [yallist (5.0.0) - npm Package Quality | Cloudsmith Navigator](/content/navigator/npm/yallist/index.html): Learn all about the quality, security, and current maintenance status of yallist using Cloudsmith Navigator (817 words)
- [safe-buffer (5.2.1) - npm Package Quality | Cloudsmith Navigator](/content/navigator/npm/safe-buffer/index.html): Learn all about the quality, security, and current maintenance status of safe-buffer using Cloudsmith Navigator (1,353 words)
- [Kong Keeps Internet Connected With Cloudsmith Distribution](/content/customers/cloudsmith-and-kong/index.html): Hear how API giant Kong went from rocky, resource-intense software delivery to flawless distribution with Cloudsmith. (2,012 words)
- [tslib (2.8.1) - npm Package Quality | Cloudsmith Navigator](/content/navigator/npm/tslib/index.html): Learn all about the quality, security, and current maintenance status of tslib using Cloudsmith Navigator (743 words)
- [ms (2.1.3) - npm Package Quality | Cloudsmith Navigator](/content/navigator/npm/ms/index.html): Learn all about the quality, security, and current maintenance status of ms using Cloudsmith Navigator (813 words)
- [readable-stream (4.7.0) - npm Package Quality | Cloudsmith Navigator](/content/navigator/npm/readable-stream/index.html): Learn all about the quality, security, and current maintenance status of readable-stream using Cloudsmith Navigator (692 words)
- [Software Supply Chain Security: July 2026 Roundup | Cloudsmith](/content/blog/cloud-native-digest-july-2026/index.html): Discover the most impactful software supply chain security incidents and industry updates from July 2026. Nigel Douglas breaks down the developments across JavaScript, Python, PHP, Rust and more. (3,500 words)
- [Trust your software supply chain from ingestion to production | Cloudsmith](/content/blog/trust-your-software-supply-chain-from-ingestion-to-production.html): The attack on SolarWinds in December 2020 was a watershed moment: it provided a stark demonstration of how much damage a compromised software supply chain could cause, and a wake-up call for how much… (1,273 words)
- [has-flag (5.0.1) - npm Package Quality | Cloudsmith Navigator](/content/navigator/npm/has-flag/index.html): Learn all about the quality, security, and current maintenance status of has-flag using Cloudsmith Navigator (233 words)
- [Meet Cloudsmith at KubeCon SLC | Artifact Management & Software Supply Chain Security](/content/events/in-person-events/kcna2026/index.html): Stop by our booth to catch lightning talks, get hands-on with interactive demos, and see how we simplify artifact management across your software supply chain.  (371 words)
- [hasown (2.0.2) - npm Package Quality | Cloudsmith Navigator](/content/navigator/npm/hasown/index.html): Learn all about the quality, security, and current maintenance status of hasown using Cloudsmith Navigator (182 words)
- [is-fullwidth-code-point (5.1.0) - npm Package Quality | Cloudsmith Navigator](/content/navigator/npm/is-fullwidth-code-point/index.html): Learn all about the quality, security, and current maintenance status of is-fullwidth-code-point using Cloudsmith Navigator (199 words)
- [Navigator Data Sources | Cloudsmith](/content/navigator/sources/index.html): Cloudsmith is a universal, cloud-native solution for software artifact management and software supply chain security. Start your free trial today. (783 words)
- [escape-string-regexp (5.0.0) - npm Package Quality | Cloudsmith Navigator](/content/navigator/npm/escape-string-regexp/index.html): Learn all about the quality, security, and current maintenance status of escape-string-regexp using Cloudsmith Navigator (199 words)
- [NPM popular packages | Cloudsmith](/content/navigator/npm/index.html): Cloudsmith is a universal, cloud-native solution for software artifact management and software supply chain security. Book a demo today. (189 words)
- [Webinar | Registry-to-runtime handoff for securing AI-driven supply chains | Cloudsmith](/content/events/webinars/registry-to-runtime-for-securing-ai-driven-supply-chains.html): AI agents add dependencies to builds faster than anyone can review them. Cloudsmith and Aikido's product leaders take one package request and show you which controls can help keep malicious packages out of your builds – at the registry, and at runtime. (339 words)
- [Cloudsmith at GitHub Universe | Artifact Management & Software Supply Chain Security](/content/events/in-person-events/github-universe-2026/index.html): Meet Cloudsmith at GitHub Universe 2026. Simplify artifact management, secure your software supply chain, and distribute software globally. (139 words)
- [Capture the Flag | Dead or alive: Hunt the malicious package | Cloudsmith](/content/events/workshops/capture-the-flag-hunt-the-malicious-package/index.html): Frontier Stack Inc. has been compromised. A malicious package is buried in their codebase. Join Cloudsmith, Chainguard, and Mend.io for a live Capture the Flag. Hunt the malicious package, and prevent it from getting into your software build. (250 words)
- [Inside the open source malware attack landscape | Cloudsmith](/content/events/webinars/inside-the-open-source-malware-attack-landscape/index.html): Open source attacks are showing up in new places – GitHub repos, npm packages, VS Code extensions. Join OpenSourceMalware and Cloudsmith to break down these new attack vectors, and what companies can do to mitigate these more advanced bad actors. (225 words)
- [Hack the AI Stack: Cloudsmith x Chainguard Hackathon](/content/events/workshops/hack-the-ai-stack-cloudsmith-and-chainguard-hackathon.html): In this Cloudsmith x Chainguard Hackathon, you’ll build and hack a real AI workload on Kubernetes - then secure it. Explore how AI supply chains break in practice and learn how to control containers, models, and dependencies before they reach production. (147 words)
- [Cloudsmith](/content/blog/page/1/index.html): Cloudsmith is a universal, cloud-native solution for software artifact management and software supply chain security. Book a demo today. (100 words)
- [Dependency Confusion and Modern Build Trust | Cloudsmith](/content/blog/dependency-confusion-and-trust-boundaries-in-modern-builds.html): Software teams can prevent dependency confusion by centralizing resolution and enforcing namespace ownership within their development pipelines. Implementing lockfiles and artifact signing further strengthens the integrity of the supply chain against unauthorized code injection. (1,093 words)
- [Vulnerability management | Cloudsmith](/content/resources/glossary/vulnerability-management/index.html): Vulnerability Management is the ongoing process of finding, assessing, prioritizing, and fixing security weaknesses in software, systems, and infrastructure. Instead of reacting only when… (448 words)
- [Keep long-lived API keys off your developer laptop | Cloudsmith](/content/blog/oidc-removed-long-lived-credentials-from-your-pipelines-what-about-your-laptop.html): Learn how Cloudsmith CLI credential helpers swap long-lived API keys on developer workstations for short-lived SAML tokens in Docker, pnpm, Cargo, and Terraform. (919 words)
- [Cloudsmith expands support to Nix](/content/blog/cloudsmith-expands-support-to-nix/index.html): Cloudsmith now supports Nix as an artifact manager. Cache NixOS channel packages, push your own builds, and rely on ED25519 signing on every read. (656 words)
- [Keyv and Cacheable npm Packages Compromised in Active Supply-Chain Attack | Cloudsmith](/content/blog/keyv-and-cacheable-npm-packages-compromised-in-active-supply-chain-attack.html): On August 4, 2026, a self-propagating worm began publishing malicious versions of the npm packages keyv and cacheable and their common dependencies. This keyv/cacheable supply-chain attack, tracked as keyv-shai-hulud, is still developing as we publish, and the list of affected npm packages has grown through the day. Below we cover what we know so far, how to check whether your organization is exposed, and the controls that stop this class of attack from reaching your builds. (1,095 words)
- [How to use Cloudsmith as a dependency firewall](/content/blog/how-to-use-cloudsmith-as-a-dependency-firewall/index.html): Learn how Cloudsmith's upstreams, continuous policy evaluation, and policy as code built on OPA combine to create a pre-ingestion dependency firewall for your software supply chain. (1,924 words)
- [Data privacy | Cloudsmith](/content/resources/glossary/data-privacy/index.html): Data Privacy refers to the responsible handling of personal and sensitive information, including how it is collected, stored, used, shared, protected, and eventually deleted.… (428 words)
- [Events & webinars | Cloudsmith](/content/events/on-demand-workshops/index.html): Meet the Cloudsmith team at the next tech conference, or join one of our regular webinars to sharpen your skills and learn best practices (80 words)
- [Tensorlake SDK npm package compromised | Cloudsmith](/content/blog/tensorlake-sdk-npm-package-compromised/index.html): Tensorlake SDK 0.5.144 installs a worm that steals npm, GitHub, and cloud credentials. Check your lockfiles, rotate secrets, and block malicious versions. (944 words)
- [Why enforce supply chain security at the artifact registry  | Cloudsmith](/content/blog/why-enforce-supply-chain-security-at-the-artifact-registry.html): Every package passes through your artifact registry. Find out how policy-as-code at ingestion reduces supply chain risk across workstations, CI, and production. (1,205 words)
- [Client logs now show the full request chain behind a package download | Cloudsmith](/content/changelog/client-logs-now-show-the-full-request-chain-behind-a-package-download.html): Client logs in the Cloudsmith web app now capture format-specific metadata across every package format Cloudsmith supports. This gives you complete visibility into the traffic being served across your workspace, including package metadata fetches across your toolchain, not just direct package downloads… (407 words)
- [CLI v1.21.0 to v1.26.0: Nix support, Cargo and pnpm credential helpers, and repository administration from your terminal | Cloudsmith](/content/changelog/cli-v1-21-0-to-v1-26-0-nix-support-cargo-and-pnpm-credential-helpers-and-repository.html): The Cloudsmith CLI has had six releases since our last update here. The headlines: you can now push Nix packages, let Cargo and pnpm authenticate automatically with credential helpers, and manage a repository's GNU Privacy Guard (GPG) key and access privileges without leaving your terminal. Along the way, the CLI got faster to start, kinder to macOS users, and better behaved on machines with no OS keyring… (808 words)
- [CLI v1.27.0 and v1.28.0: Built-in updates and a Terraform credential helper | Cloudsmith](/content/changelog/cli-v1-27-0-and-v1-28-0-built-in-updates-and-a-terraform-credential-helper.html): The Cloudsmith CLI can now update itself, so you can upgrade quickly and get back to work. The CLI also authenticates Terraform to your Cloudsmith registries without storing a token, reads your workspace settings from a new --workspace option, and keeps single sign-on (SSO) sessions alive through temporary network failures… (715 words)
- [SCIM group provisioning is now generally available | Cloudsmith](/content/changelog/scim-group-provisioning-is-now-generally-available/index.html): You can now provision Cloudsmith team membership from groups in your identity provider (IdP) on Ultra and Enterprise plans. Adding or removing a user from a mapped group in your IdP updates their Cloudsmith team membership automatically… (441 words)
- [Trace downloads through connected repositories in client log exports | Cloudsmith](/content/changelog/trace-downloads-through-connected-repositories-in-client-log-exports.html): A connected_repositories field in client log exports lists the connected repositories a package was served through, so you can trace a download back from the repository that served it… (431 words)
- [Validate your policy logic with the Cloudsmith API](/content/changelog/validate-your-policy-logic-with-the-cloudsmith-api/index.html): A new validate endpoint returns syntax and type errors in Rego policy logic without creating or updating anything, so you can fix them before you submit… (581 words)
- [CLI v1.29.0: OIDC for Buildkite and Google Cloud, and listing packages from connected repositories | Cloudsmith](/content/changelog/cli-v1-29-0-oidc-for-buildkite-and-google-cloud-and-listing-packages-from-connected-repositories.html): The Cloudsmith CLI now authenticates from Buildkite pipelines and Google Cloud workloads with OpenID Connect (OIDC), so no Cloudsmith API key needs to live on your build hosts. It can also list packages from connected repositories alongside your own… (749 words)
- [No-code software distribution using Zapier & Cloudsmith](/content/blog/for-vendors-no-code-software-distribution-using-zapier-and-cloudsmith.html): A walkthrough of how to use the Cloudsmith Zapier integration to connect your payment platform or provider to your Cloudsmith private repositories and power your Global software distribution needs. (45 words)
- [Kong Entrusts Cloudsmith With Global Distribution](/content/blog/kong-entrusts-cloudsmith-with-global-distribution/index.html): API giant Kong has handed the reins of its software distribution to Cloudsmith. Learn why in this case study recap + video… (398 words)
- [Cooldown policies now support Ruby | Cloudsmith](/content/changelog/cooldown-policies-now-support-ruby/index.html): You can now apply cooldown policies to Ruby gem packages, protecting your supply chain from newly published versions that may carry malware or have not yet undergone sufficient community scrutiny… (429 words)
- [Faster cloud-native package management with local storage and edge caching | Cloudsmith](/content/blog/were-making-the-cloud-faster-with-local-storage-and-edge-caching.html): Cloudsmith is a universal cache that really delivers in terms of accelerating software development and distribution (766 words)
- [Introducing Private Broadcasts for secure software distribution | Cloudsmith](/content/changelog/introducing-private-broadcasts-for-secure-software-distribution.html): Private Broadcasts is now available in Early Access, providing a secure solution for distributing proprietary software, such as internal SDKs, libraries, and premium commercial content… (435 words)
- [Entitlement Tokens | Cloudsmith](/content/blog/entitlement-tokens/index.html): A walkthrough of Entitlement Tokens; how to create, restrict, and permission with the use of tokens using a Maven example. (34 words)
- [Improving Observability With Cloudsmith Logs](/content/blog/improving-observability-with-cloudsmith-logs/index.html): Glimpse the golden insights Cloudsmith’s logs offer + see how easy it is to pull and analyze them like a pro. (922 words)
- [Malicious package detection | Cloudsmith](/content/resources/glossary/malicious-package-detection/index.html): Malicious package detection is the process of identifying software packages built to steal data, run hostile code, or compromise systems. (321 words)
- [License management | Cloudsmith](/content/resources/glossary/license-management/index.html): License Management is the process of tracking, controlling, and optimizing software licenses across an organization. It ensures businesses remain compliant with license agreements while… (346 words)
- [Package Delivery Networks: How They Differ From CDNs | Cloudsmith](/content/blog/package-delivery-networks-how-they-differ-from-content-delivery-networks.html): Discover the differences between a Package Delivery Network (PDN) and a Content Delivery Network (CDN). (1,203 words)
- [Auditing and Reporting In Cloudsmith | Cloudsmith](/content/blog/auditing-and-reporting-in-cloudsmith/index.html): Learn how Cloudsmith provides total transparency around how - and where - software assets are used in your organization. (495 words)
- [AI is breaking your artifact governance | Cloudsmith](/content/blog/ai-is-breaking-your-artifact-governance-and-not-by-writing-bad-code.html): Platform engineers adopting AI coding tools face a dependency throughput problem their current artifact governance wasn't calibrated for. Cloudsmith enforces policy at the point of pull to keep controls effective at AI-speed ingestion rates. (1,467 words)
- [Introducing Cloudsmith’s Advanced Observability Suite for Enterprise Artifact Management](/content/blog/introducing-cloudsmiths-advanced-observability-suite-for-enterprise-artifact-management.html): As software complexity advances, understanding what’s happening across every part of your software supply chain becomes crucial. You need to see where artifacts are used, how secure they are, and whet… (599 words)
- [Securing AI-generated code with Cloudsmith](/content/blog/securing-ai-generated-code-with-cloudsmith/index.html): Software teams can utilize programmable security policies to regulate dependencies suggested by large language models. These automated guardrails help prevent malicious supply chain attacks while maintaining rapid development cycles. (868 words)
- [Artifact Management: Complete Guide for DevOps & Security | Cloudsmith](/content/blog/artifact-management-a-complete-guide/index.html): Learn about artifact management, software artifacts, and cloud-native solutions to enhance DevOps workflows, improve security, and scale CI/CD pipelines. (2,161 words)
- [Proxy and cache packages from your ActiveState Curated Catalog | Cloudsmith](/content/changelog/proxy-and-cache-packages-from-your-activestate-curated-catalog.html): Cloudsmith now supports ActiveState Curated Catalog upstreams, with configuration built into the Libraries tab… (386 words)
- [Software Distribution Features | Cloudsmith](/content/platform-features/software-distribution/index.html): A complete list of our software distribution features, including global delivery network, high availability. (629 words)
- [How to Manage Your Package Promotion Workflows with Cloudsmith](/content/blog/how-to-manage-your-package-promotion-workflows-with-cloudsmith.html): Package promotion workflows are a great way to isolate and protect production repositories away from public upstreams, so they only receive clear and vetted packages… (1,647 words)
- [Set exact usage limits with numerical inputs | Cloudsmith](/content/changelog/set-exact-usage-limits-with-number-inputs/index.html): Usage limits used to be set with sliders, which were imprecise and cumbersome. Based on customer feedback, you can now type an exact value instead. Workspace owners and managers can set them on the workspace Settings tab, under Usage limits… (388 words)
- [Quarantine Risky Packages with Cloudsmith Policy Management](/content/blog/enterprise-policy-management-example-quarantine-packages-using-policy-as-code.html): Learn how to use Cloudsmith policy management and policy as code to detect and quarantine vulnerable or risky packages automatically. (1,080 words)
- [A Standardized Approach to SBOM | Cloudsmith](/content/blog/a-standardized-approach-to-sbom-dan-mckinney-asw-173.html): In this segment, Mike and Dan McKinney from Cloudsmith will be discussing SBOM and what that looks like for your applications. (102 words)
- [Assessing Software Supply Chain Integrity | Cloudsmith](/content/campaigns/assessing-software-supply-chain-integrity-guide/index.html): Strengthen your software supply chain with Cloudsmith’s Guide to Assessing Software Supply Chain Integrity. Based on the OpenSSF S2C2F framework, this guide explains how to build visibility, governance, and resilience into every stage of software delivery using artifact management. (256 words)
- [Cloudsmith](/content/customers/securing-the-software-supply-chain-at-a-leading-consumer-and-industrial-electronics-organization.html): Cloudsmith is a universal, cloud-native solution for software artifact management and software supply chain security. Book a demo today. (783 words)
- [Simplify repository structure with connected repositories | Cloudsmith](/content/blog/simplify-repository-structure-with-connected-repositories.html): Learn how connected repositories help platform teams choose a repository structure without the upstream sprawl that comes from adding new package formats. (1,107 words)
- [Carta Customer Success Story | Cloudsmith](/content/customers/cloudsmith-and-carta/index.html): Learn how Cloudsmith solves artifact management and distribution for Carta, a leading fintech company (460 words)
- [Performance matters: How infrastructure impacts CI/CD | Cloudsmith](/content/blog/performance-matters-how-infrastructure-impacts-ci-cd.html): Legacy artifact registries drain engineering capacity and slow CI/CD pipelines. Cloudsmith's cloud-native architecture delivers global fetch performance and eliminates manual scaling overhead. (614 words)
- [Software Artifact Management Features | Cloudsmith](/content/platform-features/artifact-management/index.html): A complete list of our software artifact management, container registry, package management features (678 words)
- [Migration Guide | Cloudsmith](/content/campaigns/cloudsmith-migration-guide/index.html): Migrating to Cloudsmith: A Comprehensive Guide to Modern Artifact Management (198 words)
- [Secure Your Software Supply Chain Using Observability | Cloudsmith](/content/events/webinars/secure-software-supply-chain-observability/index.html): Rising software supply chain attacks shape a new norm for developers and security pros. Growing observability helps preempt disruptions. Cloudsmith and invited experts discuss its impact on supply chain security. (650 words)
- [Boost compliance and security with Audit Logs | Cloudsmith](/content/changelog/boost-compliance-and-security-with-audit-logs/index.html): We're pleased to announce the release of Cloudsmith's audit logs feature to general availability. With audit logs, organizations have a historical record of activity within their Cloudsmith organization for compliance and troubleshooting purposes.

Audit logs capture all actions performed by the system, users, and service accounts. This allows an o… (512 words)
- [privacy-policy/index.html](/content/privacy-policy/index.html) (1,068 words)
- [terms-conditions/index.html](/content/terms-conditions/index.html) (1,075 words)
- [Cookie Declaration | Cloudsmith](/content/cookie-declaration/index.html): Cloudsmith is a universal, cloud-native solution for software artifact management and software supply chain security. Book a demo today. (7 words)
- [Cloudsmith Brand](/content/company/brand/index.html): Essential information about the Cloudsmith brand, including assets, guidelines (264 words)
- [Contact Cloudsmith](/content/company/contact-us/index.html): Get in touch with Cloudsmith to ask questions, learn more about the product, or access support. We're here to help. (151 words)
- [Cloudsmith Newsroom](/content/company/press/index.html): Cloudsmith Newsroom featuring press announcements and news coverage of Cloudsmith; a fully-managed artifact management solution.  (617 words)
- [The Tao of Cloudsmith](/content/company/the-tao-of-cloudsmith/index.html): The foundational formative thoughts and guiding principles for Cloudsmith (357 words)
- [Customer Stories | Cloudsmith](/content/customers/index.html): We love our customers, and we work closely with all of them to make the storage, management and distribution of software assets as straightforward as possible. Discover how organizations are using Cloudsmith. (372 words)
- [Secure Artifact Management for Aviation, Transportation & Logistics | Cloudsmith](/content/solutions/aviation-transportation-logistics/index.html): Cloudsmith is a fully managed, cloud-native artifact management platform built for the strict security, compliance, and reliability demands of aviation, transportation, and logistics. (1,363 words)
- [10 GitHub Universe 2026 sessions not to miss | Cloudsmith](/content/blog/10-github-universe-2026-sessions-not-to-miss/index.html): Plan your GitHub Universe 2026 agenda with 10 must-see sessions on supply chain security, agentic workflows and platform engineering. Find Cloudsmith in the Festival Pavilion. (1,843 words)
- [Enterprise Artifact Management for the AI Era | Cloudsmith](/content/solutions/software-technology/index.html): Fully managed artifact management for the AI era. Every dependency your developers and AI agents pull is proxied and checked against your policy-as-code. (849 words)
- [20 October 2026: eMudhra intermediate CA certificates | Cloudsmith](/content/blog/emudhra-intermediate-ca-certificates-customer-comms.html): What happened

On 20 October 2026, it was disclosed that the private keys for eight eMudhra intermediate CA certificates were incorrectly generated and can be recovered by anyone. An attacker could us… (407 words)
- [Everything Cloudsmith shipped in Q3 2026](/content/blog/everything-cloudsmith-shipped-in-q3-2026/index.html): See everything Cloudsmith shipped in Q3 2026, including GA policy management, continuous risk detection, and cooldown policies for Go, Maven, Docker, and Cargo. (1,701 words)
- [Secure Artifact Management for Banking, Fintech and Insurtech | Cloudsmith](/content/solutions/fintech-banking-financial-services/index.html): Cloudsmith is a fully managed, global-scale alternative to legacy artifact management, with policy-as-code supply chain security for banking, fintech and insurtech. (1,202 words)
- [Artifact Management for AI Agents and AI-Built Software | Cloudsmith](/content/solutions/artificial-intelligence-data-science-machine-learning.html): Give AI agents a trusted source for every dependency. Cloudsmith applies your policies before packages arrive and gives agents your engineering context. (1,333 words)
- [Real-time risk detection replaces stale package scans | Cloudsmith](/content/blog/how-continuous-risk-detection-replaces-point-in-time-scans-with-real-time-monitoring.html): Hundreds of new CVEs get published every day. See how Cloudsmith's continuous risk detection uses matching to keep repository risk data current without constant rescanning. (884 words)
- [Events & webinars | Cloudsmith](/content/events/on-demand-webinars/index.html): Meet the Cloudsmith team at the next tech conference, or join one of our regular webinars to sharpen your skills and learn best practices (303 words)
- [From JFrog Cloud to Cloudsmith: How ConstructConnect strengthened security and simplified software delivery](/content/customers/cloudsmith-and-constructconnect/index.html): Learn how ConstructConnect migrated from JFrog Cloud to Cloudsmith to improve supply chain security, simplify CI/CD, reduce costs, and scale multi-format artifact management. (1,727 words)
- [Zero Outages with Cloudsmith: The New England Center for Children](/content/customers/cloudsmith-and-the-new-england-center-for-children/index.html): Discover how The New England Center for Children eliminated outages, sped up builds and scaled effortlessly with Cloudsmith's cloud-native platform. (1,524 words)
- [Software Supply Chain Security Features | Cloudsmith](/content/platform-features/software-supply-chain-security/index.html): Explore Cloudsmith features for software supply chain security, including policy management, SBOMs, package quarantine, signing, and risk detection. (915 words)
- [How Cloudsmith enforces security policy at the registry](/content/blog/how-cloudsmith-security-features-work-policy-risk-detection-and-the-audit-trail.html): Cloudsmith moves enforcement to the registry itself. This post covers the OPA Rego policy engine, cooldown periods, continuous re-evaluation, and the decision logs that back each one up. (954 words)
- [DataHub streamlines distribution with Cloudsmith](/content/customers/cloudsmith-and-datahub/index.html): Discover how DataHub utilizes Cloudsmith to eliminate distribution friction and manage enterprise software delivery with entitlement tokens. The platform provides a secure and scalable alternative to legacy systems for managing global artifact accessibility. (953 words)
- [AI Artifacts: The New Software Supply Chain Blind Spot | Cloudsmith](/content/blog/ai-artifacts-the-new-software-supply-chain-blind-spot.html): AI-generated code, models, and orchestration tools are reshaping software supply-chain security. Learn the new risks and how to secure AI artifacts. (340 words)
- [Secure Your Software Supply Chain | Book a Demo | Cloudsmith](/content/book-a-demo-supply-chain-security/index.html): See how Cloudsmith helps engineering and security teams control artifact integrity, enforce policy, and eliminate supply chain risk. Book a demo today. (58 words)
- [Cloudsmith glossary](/content/resources/glossary/index.html): Definitions for software supply chain security, artifact management, compliance, and cloud-native delivery. (772 words)
- [2026 Artifact Management Report | Cloudsmith](/content/campaigns/2026-artifact-management-report/index.html): The 2026 Artifact Management Report examines the structural vulnerabilities now embedded in modern development pipelines, and the operational, regulatory, and architectural responses required to address them. (687 words)
- [Cloudsmith: Secure alternative to AWS CodeArtifact](/content/switch/aws-codeartifact/index.html): Looking for an alternative to AWS CodeArtifact? See a head-to-head analysis of Cloudsmith vs AWS CodeArtifact on features, pricing, and security to choose the best artifact repository. (900 words)
- [Cloudsmith Navigator](/content/navigator/index.html): Cloudsmith Navigator integrates and analyzes the most reliable sources of information on OSS packages, helping you make the best choice for your project (650 words)
- [Events & webinars | Cloudsmith](/content/events/webinars/index.html): Meet the Cloudsmith team at the next tech conference, or join one of our regular webinars to sharpen your skills and learn best practices (160 words)
- [ROI Calculator | Cloudsmith](/content/resources/return-on-investment-calculator/index.html): Cloudsmith is a universal, cloud-native solution for software artifact management and software supply chain security. Book a demo today. (197 words)
- [Cloudsmith Software Supply Chain Security Assessment](/content/resources/artifact-security-maturity-tool/index.html): Assess your artifact and supply chain security in 20 questions. See where your team is strongest, where risk remains, and what to prioritize next. (690 words)
- [Events & webinars | Cloudsmith](/content/events/index.html): Meet the Cloudsmith team at the next tech conference, or join one of our regular webinars to sharpen your skills and learn best practices (391 words)
- [Cloudsmith Product Tour: Master Artifact Management](/content/product-tour/index.html): Explore demo videos on Cloudsmith—covering artifact management, CI/CD setup, security, compliance, and API automation for your software supply chain. (455 words)
- [Cloudsmith: Alternative to Sonatype Nexus Repository](/content/switch/sonatype-nexus/index.html): Looking for a Sonatype alternative? See a head-to-head analysis of Cloudsmith vs Sonatype on features, pricing, and security to choose the best artifact repository. (814 words)
- [Book a migration consultation with Cloudsmith](/content/book-a-migration-consultation/index.html): Book a consultation with a Cloudsmith expert (44 words)
- [Cloudsmith vs GitHub Packages | Best GitHub Packages alternative](/content/switch/github-packages/index.html): Comparing Cloudsmith vs GitHub Packages? See a head-to-head analysis on formats, security, reliability, and pricing. Discover why teams switch to Cloudsmith. (1,201 words)
- [Cloudsmith: Blog and Thoughts on Artifact Management](/content/blog/index.html): We've packaged these resources to help you learn more about Cloudsmith: Secure, Universal Artifact Management, Made Simple! (244 words)
- [Cloudsmith vs Artifactory | Best JFrog artifactory alternative](/content/switch/jfrog-artifactory/index.html): Comparing Cloudsmith vs Artifactory? See a head-to-head analysis of Cloudsmith vs JFrog Artifactory on features, pricing, and security to choose the best artifact repository. (660 words)
- [Changelog: Cloudsmith improvements, feature announcements, changes](/content/changelog/index.html): Keep up to date with the Cloudsmith service and API via our changelog. Subscribe for updates via RSS, or get our monthly product bulletin sent to your inbox. (524 words)
- [Font Awesome Customer Success Story | Cloudsmith](/content/customers/cloudsmith-and-fontawesome/index.html): Learn how Cloudsmith solves digital artifact distribution and licensing at a global scale for Font Awesome (514 words)
- [PagerDuty Eliminates Downtime With Cloudsmith Migration](/content/customers/cloudsmith-and-pagerduty/index.html): See how we've saved PagerDuty from pipeline disruption, support bottlenecks + more with first-class performance + service (1,334 words)
- [Cloudsmith Pricing | Artifact Management Plans](/content/pricing/index.html): Explore Cloudsmith pricing and plans for artifact management, software supply chain security, package delivery, and global software distribution. (1,148 words)
- [Book a demo with a Cloudsmith expert](/content/book-a-demo/index.html): Book a demo with a Cloudsmith expert (55 words)
- [Dependency attacks 2026: The confidence gap | Cloudsmith](/content/campaigns/dependency-attacks-2026-the-confidence-gap/index.html): Survey of 400 engineers reveals a confidence gap in software supply chain security: 73% trust their tooling, but few stop install-time attacks in time. (291 words)

## Listings & Categories

- [Tagged with Artifact Management | Cloudsmith](/content/blog/tag/artifact-management/index.html): Cloudsmith is a universal, cloud-native solution for software artifact management and software supply chain security. Book a demo today. (149 words)
- [Supply chain security | Cloudsmith](/content/blog/category/security/index.html): Cloudsmith is a universal, cloud-native solution for software artifact management and software supply chain security. Book a demo today. (233 words)
- [Posts by Jason Myers | Cloudsmith](/content/blog/author/jason-myers/index.html): Cloudsmith is a universal, cloud-native solution for software artifact management and software supply chain security. Book a demo today. (115 words)
- [Artifact management | Cloudsmith](/content/blog/category/artifact-management/index.html): Cloudsmith is a universal, cloud-native solution for software artifact management and software supply chain security. Book a demo today. (191 words)
- [Posts by Claire McDyre | Cloudsmith](/content/blog/author/claire-mcdyre/index.html): Cloudsmith is a universal, cloud-native solution for software artifact management and software supply chain security. Book a demo today. (29 words)
- [New | Cloudsmith](/content/changelog/category/new/index.html): Cloudsmith is a universal, cloud-native solution for software artifact management and software supply chain security. Book a demo today. (468 words)
- [Scaling & performance | Cloudsmith](/content/blog/category/scaling-performance/index.html): Cloudsmith is a universal, cloud-native solution for software artifact management and software supply chain security. Book a demo today. (203 words)
- [Improvement | Cloudsmith](/content/changelog/category/improvement/index.html): Cloudsmith is a universal, cloud-native solution for software artifact management and software supply chain security. Book a demo today. (432 words)
- [Tagged with software supply chain security | Cloudsmith](/content/blog/tag/software-supply-chain-security/index.html): Cloudsmith is a universal, cloud-native solution for software artifact management and software supply chain security. Book a demo today. (155 words)
- [Posts by Parul Jhawar | Cloudsmith](/content/blog/author/parul-jhawar/index.html): Cloudsmith is a universal, cloud-native solution for software artifact management and software supply chain security. Book a demo today. (115 words)

## Products

- [Zapier Integration | Cloudsmith](/content/product/integrations/zapier/index.html): Automate Cloudsmith entitlement token creation and revocation using Zapier. Connect to thousands of apps and trigger token workflows without writing code. (691 words)
- [Cloudsmith Webhooks Integration - Real-time Package Event Notifications](/content/product/integrations/webhooks/index.html): Trigger CI/CD pipelines, ChatOps alerts, and custom automations the moment package events fire in Cloudsmith. Secure, flexible, and zero-polling. (1,094 words)
- [Slack Integration | Cloudsmith](/content/product/integrations/slack/index.html): Connect Cloudsmith to Slack and get real-time notifications for every package event in your repositories. Set up in minutes using incoming webhooks and Handlebars templates. (1,018 words)
- [Puppet Integration - Cloudsmith](/content/product/integrations/puppet/index.html): Use Cloudsmith with Puppet to serve secure, GPG-signed private packages to your infrastructure nodes. Native apt and yum support, flexible authentication, and full audit trails. (677 words)
- [Cloudsmith Notifications in Microsoft Teams](/content/product/integrations/microsoft-teams/index.html): Get real-time alerts on artifact activity in Teams from Cloudsmith. (68 words)
- [Dependabot and Cloudsmith: Automated Dependency Updates for Private Registries](/content/product/integrations/dependabot/index.html): Connect Dependabot to Cloudsmith to automate updates for private and public dependencies. Supports username/password and OIDC authentication across all major package ecosystems. (1,080 words)
- [Software Supply Chain Policy Enforcement | Cloudsmith](/content/product/policy-management/index.html): Cloudsmith policy management gives you centralized, automated control over every package, dependency, and container moving through your supply chain, including those pulled by AI agents. (1,248 words)
- [Octopus Deploy Integration - Cloudsmith Artifact Management](/content/product/integrations/octopus-deploy/index.html): Use Cloudsmith as a secure, multi-format external feed for Octopus Deploy. NuGet, Docker, Maven, and Helm packages with full access control, vulnerability scanning, and audit trails. (1,118 words)
- [Okta SSO and SCIM Integration with Cloudsmith](/content/product/integrations/okta/index.html): Connect Okta to Cloudsmith for SAML 2.0 SSO, SCIM 2.0 user provisioning, and automated group-to-team mapping. Centralise identity and access control across all your artifact repositories. (960 words)
- [GitLab CI/CD Integration | Cloudsmith](/content/product/integrations/gitlab-cicd/index.html): Connect GitLab CI/CD pipelines to Cloudsmith and push any package format into a secure, fully managed artifact repository. Better than storing artifacts in GitLab. (1,068 words)
- [Buildkite and Cloudsmith: Artifact Management for CI/CD Pipelines](/content/product/integrations/buildkite/index.html): Connect Buildkite with Cloudsmith to publish, store, and distribute packages from your pipelines. Secure authentication, multi-format support, and global delivery included. (909 words)
- [Harness CD Integration | Cloudsmith](/content/product/integrations/harness-cd/index.html): Connect Cloudsmith to Harness CD for secure, auditable artifact delivery. Authenticate with API keys or Entitlement Tokens, add Cloudsmith as an Artifact Server, and promote packages across every pipeline stage. (884 words)
- [Chef Integration | Cloudsmith](/content/product/integrations/chef/index.html): Store, secure, and distribute Chef cookbooks from Cloudsmith. Fine-grained access control, vulnerability scanning, and global CDN delivery for your infrastructure automation pipelines. (724 words)
- [Travis CI Integration | Cloudsmith](/content/product/integrations/travis-ci/index.html): Push artifacts from Travis CI pipelines directly to Cloudsmith. Secure API key authentication, multi-format support, and full audit trails - all in a fully managed registry. (744 words)
- [Azure AD SSO Integration | Cloudsmith](/content/product/integrations/azure-ad-sso/index.html): Use our Azure AD single-sign integration to control access to your artifacts stored in Cloudsmith (107 words)
- [Google SSO Integration | Cloudsmith](/content/product/integrations/generic-sso/index.html): Use our Google SSO integration to control access to your artifacts stored in Cloudsmith (90 words)
- [Use Azure DevOps with Cloudsmith](/content/product/integrations/microsoft-azure-devops/index.html): Publish and consume artifacts in Azure DevOps with secure Cloudsmith integration. (73 words)
- [Drone CI/CD Integration with Cloudsmith](/content/product/integrations/drone-ci/index.html): Push and pull packages in Drone CI workflows using Cloudsmith's secure repositories. (68 words)
- [Continuous risk detection | Cloudsmith](/content/product/continuous-risk-detection/index.html): Continuous risk detection from Cloudsmith surfaces newly disclosed risks automatically with continuous monitoring of packages against the latest security advisories.
 (607 words)
- [product/formats/hugging-face/index.html](/content/product/formats/hugging-face/index.html) (1,278 words)
- [Private Vagrant Box Registry - Secure, Managed, Cloud-Native | Cloudsmith](/content/product/formats/vagrant-repository/index.html): Host and distribute Vagrant boxes in a fully managed private registry. Fine-grained access control, vulnerability scanning, global CDN delivery, and multi-format support. Try Cloudsmith today. (1,187 words)
- [Unity Package Registry - Private, Secure, Cloud-Native | Cloudsmith](/content/product/formats/unity-repository/index.html): Host Unity UPM packages in secure, private, cloud-native repositories with Cloudsmith. Push and pull via native npm tooling, enforce access controls, and ship faster. (1,032 words)
- [Private Terraform Module Registry | Cloudsmith](/content/product/formats/terraform-registry/index.html): Host and distribute private Terraform modules with version constraints, entitlement tokens, and native terraform init support. Fully managed on Cloudsmith. (1,342 words)
- [Private, secure, hosted Swift registry | Cloudsmith](/content/product/formats/swift/index.html): Cloudsmith gives you a fully managed Swift package registry with native SPM support, package signing, upstream proxying, and global CDN distribution. Start today. (1,029 words)
- [Private Ruby Gems Registry | Cloudsmith](/content/product/formats/ruby-repository/index.html): Host, secure, and distribute private Ruby gems with Cloudsmith. Entitlement tokens, upstream proxying from rubygems.org, CVE scanning, OIDC auth, and 600+ edge PoPs. Trusted by teams like Shopify. (1,710 words)
- [Private, secure, hosted SBT repository | Cloudsmith](/content/product/formats/sbt-repository/index.html): Host your Scala and Java sbt packages in secure, private, cloud-native repositories on Cloudsmith. Upstream proxying, policy enforcement, and global delivery included. (1,160 words)
- [Secure Red Hat RPM Repository Management | Cloudsmith](/content/product/formats/rpm-repository/index.html): Cloudsmith gives engineering teams a private, secure proxy layer in front of RHEL registries. CVE scanning, GPG signing, upstream caching, and full audit logs for every RPM package. (1,331 words)
- [Raw and Generic Artifact Repository | Cloudsmith](/content/product/formats/raw-repository/index.html): Store, secure, and distribute any binary or file type alongside your packages and containers. Cloudsmith is the single source of truth for all software artifacts. (1,331 words)
- [Private R / CRAN Repository for Data Science Teams | Cloudsmith](/content/product/formats/cran-repository/index.html): Cloudsmith gives data science teams a fully-managed private CRAN repository with upstream proxying, vulnerability scanning, and fine-grained access control. Start your free trial today. (1,203 words)
- [Private PowerShell Module Repository | Cloudsmith](/content/product/formats/powershell-repository/index.html): Host secure, private PowerShell module repositories on Cloudsmith. NuGet-compatible feeds, vulnerability scanning, access controls, and global CDN delivery. Book a demo. (1,350 words)
- [Private Python repository - secure, fast, cloud-native | Cloudsmith](/content/product/formats/python-repository/index.html): Cloudsmith gives your teams a fully-managed private Python registry with upstream proxying, vulnerability scanning, OIDC auth, and 600+ edge PoPs. Python is one of our most widely-used formats. (1,423 words)
- [Nix repository management | Cloudsmith](/content/product/formats/nix/index.html): Host a public or private Nix binary cache with ED25519 signing and NixOS upstream proxying, governed alongside your other 30+ formats in one managed platform. (1,028 words)
- [Private NuGet Feed - Secure, Hosted Package Management | Cloudsmith](/content/product/formats/nuget-feed-old/index.html): Cloudsmith gives your .NET teams a fully managed private NuGet feed with security scanning, native signing, upstream proxying, and entitlement token auth. Start today. (852 words)
- [Private, secure, hosted P2 repository | Cloudsmith](/content/product/formats/p2-repository/index.html): Host Eclipse P2 update sites in secure, cloud-native repositories with Cloudsmith. Book a demo today. (176 words)
- [Cloudsmith AI Model Registry](/content/product/hugging-face-registry/index.html): Securely manage and distribute Hugging Face and other AI models with Cloudsmith’s AI Model Registry - designed to give teams full control of their AI artifacts in the software supply chain. (1,278 words)
- [Private NPM Registry | Secure npm Package Management | Cloudsmith](/content/product/formats/npm/index.html): Host private and public NPM packages with Cloudsmith. Full npm CLI compatibility, vulnerability scanning, upstream proxying, and policy-as-code - all in a fully managed registry. (925 words)
- [Maven Repository | Secure, Managed Maven Artifact Management | Cloudsmith](/content/product/formats/maven-repository/index.html): Host private Maven repositories on Cloudsmith. Proxy Maven Central, scan for CVEs, enforce policy, and manage JARs, POMs, and SNAPSHOTs with native tooling. No infrastructure to run. (1,123 words)
- [Private LuaRocks Repository | Cloudsmith](/content/product/formats/luarocks-repository/index.html): Host private Lua modules on Cloudsmith. Global CDN delivery, vulnerability scanning, entitlement token auth, and native LuaRocks tool support. Get started today. (1,175 words)
- [Private, secure, hosted Docker registry | Cloudsmith](/content/product/formats/docker-registry/index.html): Cloudsmith offers secure, private Docker registries as a service, with cloud native performance. Book a demo today.  (1,180 words)
- [Private Gradle Repository | Cloudsmith Artifact Management](/content/product/formats/gradle-repository/index.html): Host secure, private Gradle repositories on Cloudsmith. Cloud-native artifact management with entitlement token auth, governance policies, upstream proxying, and 600+ edge PoPs for fast dependency resolution. (957 words)
- [Private, secure, hosted Go repository | Cloudsmith](/content/product/formats/go-repository/index.html): Use Cloudsmith to host Go modules in secure, cloud-native, private repositories. Book a demo today. (237 words)
- [Managed Conda Repository | Private, Secure Conda Hosting | Cloudsmith](/content/product/formats/conda-repository/index.html): Host private Conda repositories on Cloudsmith. Proxy public channels like conda-forge, enforce governance policies, and deliver packages globally with a fully managed cloud-native registry. (1,093 words)
- [Private, secure Composer repository for PHP teams | Cloudsmith](/content/product/formats/composer-repository/index.html): Host and control your PHP Composer packages in Cloudsmith. Private repositories, vulnerability scanning, upstream proxying, and granular access controls - all fully managed. (1,132 words)
- [Private CocoaPods Repository - Manage Pods After Trunk Shutdown | Cloudsmith](/content/product/formats/cocoapods-repository/index.html): CocoaPods trunk goes read-only in December 2026. Cloudsmith gives your team a private, fully-managed CocoaPods repository with governance policies, global edge delivery, and access controls to keep your iOS and macOS builds stable long-term. (1,482 words)
- [Private Chocolatey Repository | Cloudsmith](/content/product/formats/chocolatey-repository/index.html): Host and govern your Chocolatey packages on Cloudsmith. Fully managed, cloud-native private repositories with access control, policy enforcement, and global distribution. Book a demo. (1,187 words)
- [Cargo Registry Hosting | Private Rust Crate Registry | Cloudsmith](/content/product/formats/cargo/index.html): Host private Cargo registries for Rust on Cloudsmith. Get vulnerability scanning, policy-as-code, crates.io proxying, and a global CDN - fully managed and enterprise-ready. (1,305 words)
- [Private Helm Chart Repository | Cloudsmith](/content/product/formats/helm-chart-repository/index.html): Host secure, private Helm chart repositories on Cloudsmith. Global CDN delivery, governance policy controls, and full CLI support. Book a demo today. (1,272 words)
- [Cooldown & Minimum Package Age Policies | Cloudsmith](/content/product/package-cooldown-policies/index.html): Cloudsmith cooldown policies enforce a minimum package age blocking newly published packages until they clear review. (1,082 words)
- [Aikido Container Vulnerability Scanning | Cloudsmith](/content/product/integrations/aikido/index.html): Scan every container image stored in Cloudsmith for known vulnerabilities with Aikido. Reduce false positives, get clear remediation guidance, and start free. (699 words)
- [Ping Identity SAML SSO Integration for Cloudsmith](/content/product/integrations/ping-federate-identity/index.html): Connect Ping Identity or PingFederate to Cloudsmith via SAML 2.0. Centralise access control, automate team provisioning with SAML Group Sync, and enforce SSO across all your artifact repositories. (959 words)
- [Cloudsmith + Kusari: End-to-End Software Supply Chain Security](/content/product/integrations/kusari/index.html): Combine Kusari's build-time SBOM generation, provenance attestation, and vulnerability triage with Cloudsmith's policy-enforced artifact distribution. Secure your supply chain from commit to production. (945 words)
- [CircleCI Integration - Publish Packages with Cloudsmith](/content/product/integrations/circle-ci/index.html): Connect CircleCI to Cloudsmith using the official orb. Publish packages across 30+ formats, enforce security policies, and get full traceability on every artifact your pipelines produce. (952 words)
- [Integrate Cloudsmith with Argo CD](/content/product/integrations/argocd/index.html): Use Cloudsmith as the artifact registry behind your Argo CD GitOps workflows. Securely store Helm charts and Docker images, authenticate with OIDC or Entitlement tokens, and automate Kubernetes deployments with confidence. (952 words)
- [Datadog Integration | Monitor Cloudsmith in Datadog](/content/product/integrations/datadog/index.html): Surface Cloudsmith storage, bandwidth, token usage, vulnerability scan results, and audit logs directly in Datadog. Unified observability for your artifact platform. (906 words)
- [Cloudsmith for Roadie: Artifact Visibility in Your Developer Portal](/content/product/integrations/roadie/index.html): Surface Cloudsmith package stats, quota usage, audit logs, and security scan results directly inside your Roadie developer portal. Zero context switching for your engineering teams. (971 words)
- [Terraform Provider for Cloudsmith](/content/product/integrations/terraform-provider/index.html): Provision and manage Cloudsmith repositories, access controls, and entitlement tokens as infrastructure code. The official Terraform Provider for Cloudsmith is available on the Terraform Registry. (838 words)
- [Jenkins Integration with Cloudsmith](/content/product/integrations/jenkins/index.html): Connect Jenkins pipelines to Cloudsmith for secure, cloud-native artifact management. Push and pull packages across 30+ formats with OIDC authentication and full audit trails. (933 words)
- [GitHub Actions Integration - Cloudsmith](/content/product/integrations/github-actions/index.html): Connect GitHub Actions to Cloudsmith to publish packages, authenticate with OIDC, and enforce artifact policies automatically in every CI/CD workflow. (923 words)
- [Integrate Cloudsmith with VS Code | Manage Packages Easily](/content/product/integrations/vscode/index.html): Bring Cloudsmith package management into VS Code. Browse, inspect, and manage repositories without leaving your IDE to boost developer productivity. (943 words)
- [Bitbucket Pipelines Integration | Cloudsmith](/content/product/integrations/bitbucket-pipelines/index.html): Publish packages from Bitbucket Pipelines to Cloudsmith with the official Cloudsmith pipe. Secure artifact storage, multi-format support, and full pipeline traceability. (952 words)
- [Ansible Integration | Cloudsmith](/content/product/integrations/ansible/index.html): Connect Ansible to Cloudsmith to deploy packages from secure, centralized repositories. Fine-grained access control, entitlement tokens, and full audit logging included. (949 words)
- [Integrate Codefresh with Cloudsmith](/content/product/integrations/codefresh/index.html): Connect Codefresh pipelines to Cloudsmith for secure, centralised artifact management. Supports Docker, Helm, and multi-format packages with OIDC authentication. (727 words)
- [Integrating Cloudsmith with Chainguard Containers](/content/product/integrations/chainguard-containers/index.html): Use Cloudsmith with Chainguard Containers to securely distribute minimal, hardened container images across your software supply chain. (690 words)
- [GitHub Secret Scanning Integration | Cloudsmith](/content/product/integrations/github-secret-scanning/index.html): Cloudsmith integrates with GitHub Secret Scanning to automatically detect, notify, and revoke exposed API keys. Keep credentials safe without slowing your team down. (674 words)
- [OneLogin SSO Integration - Cloudsmith](/content/product/integrations/onelogin-sso/index.html): Connect OneLogin to Cloudsmith via SAML 2.0 and SCIM 2.0. Enforce SSO-only access, automate user provisioning, and sync team permissions across your artifact repositories. (399 words)
- [Semaphore CI/CD with Cloudsmith](/content/product/integrations/semaphore-ci/index.html): Use Cloudsmith's Semaphore integration to push packages to Cloudsmith as part of your workflows (108 words)
- [Enable JumpCloud SSO with Cloudsmith](/content/product/integrations/jumpcloud-sso/index.html): Authenticate users securely in Cloudsmith using JumpCloud’s identity platform. (87 words)
- [AWS CodeBuild Integration | Cloudsmith](/content/product/integrations/aws-codebuild/index.html): Use Cloudsmith as a target for all the assets created by AWS CodeBuild (97 words)
- [Private Dart Package Repository | Cloudsmith](/content/product/formats/dart-repository/index.html): Host secure, private Dart repositories on Cloudsmith. Token-based auth, upstream proxying, package governance, and vulnerability scanning - fully managed. (1,112 words)
- [Private Debian APT Repository as a Service | Cloudsmith](/content/product/formats/debian-repository/index.html): Cloudsmith gives you a secure, fully-managed private Debian APT repository with native .deb support, vulnerability scanning, and global CDN delivery. Get started today. (1,166 words)
- [Cloudsmith: Global Software Distribution Solution](/content/product/global-software-distribution/index.html): A fully-managed, globally-distributed software distribution platform built for high availability and high speed software delivery. (598 words)
- [Cloudsmith Broadcasts Distribution Portal](/content/product/cloudsmith-broadcasts/index.html): With Broadcasts your customers and users can discover and download your software via a themed portal, at your own domain. (401 words)
- [Supply Chain Observability and Governance | Cloudsmith](/content/product/observability-governance/index.html): Govern and observe every dependency your teams and AI agents pull. Enforce policy as code and get complete logs and a full audit trail. (745 words)
- [Software Supply Chain Security Solution | Cloudsmith](/content/product/software-supply-chain-security/index.html): Secure your software supply chain with policy enforcement, malicious package blocking, continuous risk detection, and SBOM management. (889 words)
- [Alpine Linux Repository | Private APK Hosting | Cloudsmith](/content/product/formats/alpine-repository/index.html): Host and distribute Alpine Linux packages with Cloudsmith. Secure private repositories, native apk tooling, upstream proxying, RSA signing, and CVE scanning. Get started today. (785 words)
- [Cloudsmith: Package Management & Container Registry Solution](/content/product/cloud-native-artifact-management/index.html): A fully-managed, enterprise-scale software package management platform and private container registry.  (612 words)
- [Supported Software Package Formats | Cloudsmith](/content/product/formats/index.html): Cloudsmith is a cloud-native artifact management solution that supports 28 package formats, and raw files of any type (20 words)

## About Pages

- [About Cloudsmith](/content/company/about/index.html): Cloudsmith is the fully-managed solution for controlling, securing, and distributing software artifacts. We're building the future of the software supply chain.  (223 words)

## Resources

- [Full Page Index](/index.html): Browse all cached pages with rich metadata
- [About This Cache](/about.html): Methodology, technical details, and usage guidelines
- [XML Sitemap](/sitemap.xml): Machine-readable sitemap for crawler discovery
- [Robots.txt](/robots.txt): Crawler directives
- [Agentsite Network](https://agentsite.network/network.html): Public index of Agentsites and their machine-readable resources