Cloudsmith

Ship trusted software, fast. Cloud-native artifact management for the AI era — security enforced before packages reach your build environment.

[Cloudsmith @cloudsmith]

The logic is rather simple: if you can compromise the framework itself, you have the ability to compromise highly sensitive infrastructure. Today, it's happened again - this time #Mastra was the target. Full attack breakdown: https://t.co/QVQ5BOLvnA

[Cloudsmith @cloudsmith]

Automate now > explain to regulators later.

87 days until the CRA's 24-hour reporting rule kicks in. We broke down what engineering teams should be working towards for compliance.

https://t.co/dW2v4RYhRb

[Cloudsmith @cloudsmith]

Move fast (with guardrails).

[Cloudsmith @cloudsmith]

Your artifact registry and your deployment tool shouldn't be strangers. Cloudsmith decides what's allowed. @OctopusDeploy controls how it ships. Governance baked in, not bolted on. https://t.co/KHKTYr0Jrp

[Cloudsmith @cloudsmith]

Valid SLSA attestations. Legitimate OIDC tokens. 73 repos down. The Miasma worm shows why signed isn't the same as safe. https://t.co/kVHB9S4BQb

[Cloudsmith @cloudsmith]

AI coding tools are pulling in dependencies faster than any senior engineer can review them.

AI's speed, matched with automation, guardrails, and a strong artifact management layer, provides a secure development foundation.
Here's how we think about it. ↓

[Cloudsmith @cloudsmith]

Join @cloudsmith, @rootlyhq, https://t.co/Nk418e6lpE, @ClickHouseDB, and @Docker in NYC for an evening of cocktails, conversations, and connections.

📍 Diamante’s | 410 8th Ave, NYC
📅 Wed, June 17 | 5:30-8:30 PM

🍸 RSVP: https://t.co/08vkvEfFhN

[Cloudsmith @cloudsmith]

Are you at PlatformCon London?

Join Spacelift and Cloudsmith TONIGHT at F1 Arcade London for an evening where competitive racing meets DevOps and platform engineering. Connect with peers, test your skills on full-spec racing simulators, and explore how to optimize your DevOps for both speed and control.

📅 Date: Wednesday, 25 June
⏰ Time: 7:00 PM - 10:00 PM BST
📍 Location: F1 Arcade London - 1 New Change, London EC4M 9AF, United Kingdom

🔥 Space is limited—reserve your spot now! 🔥
👉 https://t.co/DIL2MgMkky

See you there!

[Cloudsmith @cloudsmith]

Is your Helm a risk? 🔍

If your business or open-source project relies on Helm charts, join Nigel Douglas, Head of Developer Relations at Cloudsmith, in a hands-on, virtual workshop during PlatformCon 2025: "What Supply Chain Risks Are Hidden in Your Helm Charts?"

Join this hands-on workshop to explore real-world Helm vulnerabilities and learn practical strategies to automate and strengthen your Kubernetes security posture.

Reserve your spot 👉 https://t.co/fpmfsmp4cH

🗓️ Friday, 27 June at 4:00 PM BST / 11:00 AM EST
📍 Virtual

#PlatformEngineering #PlatformCon2025 #KubernetesSecurity #Helm

[Cloudsmith @cloudsmith]

We're thrilled to be part of PlatformCon 2025, the world’s largest platform engineering conference! This year, we're bringing two high-impact virtual talks to the stage 💥

More Than Code: How Culture Defines Platform Success
Explore how team culture, not just tooling, shapes the true success of platform engineering 🌟

Artifact Management Unleashed: Powering Your Packages at Lightning Speed
Discover how to optimize package delivery and streamline your artifact workflows for peak performance 🚀

This week only, PlatformCon attendees can enter to win a $250 gift card at the end of each talk!

Watch now: https://t.co/Ev118HFRW8

#PlatformEngineering #PlatformCon25

[Cloudsmith @cloudsmith]

In April, Scattered Spider cracked M&S’s systems in a massive ransomware attack.

It all started with the theft of an NTDS.dit file.

See Nigel Douglas’s advice for practitioners securing their CI/CD pipelines against lateral movement: https://t.co/E8ARSVYDaR

Full guide: https://t.co/i383aZOnMt

#DevSecOps #OWASP #CI/CD

[Cloudsmith @cloudsmith]

🌍 Cloudsmith is proud to sponsor PlatformCon 2025 - the worlds biggest platform engineering event!

Join us for a full week of all things platform engineering—including free virtual sessions packed with insights into cloud-native artifact management at scale 🚀

Here’s what we’re bringing to the table:

💡 23-27 June | 2 Virtual Talks
• More Than Code: How Culture Defines Platform Success — Explore how platform strategy aligned with company goals enables empowered engineering teams.
• Artifact Management Unleashed: Powering Your Packages at Lightning Speed — Discover how smart caching and optimized registry access can supercharge your package delivery.

🇬🇧 25 June | London Live Day - Booth 8
• Stop by Booth 8 to see why Cloudsmith is the world’s best cloud-native artifact management platform—fully managed, built for scale, and designed to secure and streamline everything in your software supply chain.
• Get hands-on with the Cloudsmith platform, enter to win great prizes, and take home great swag!
🗓️ When: Wednesday, 25 June
📍 Where: Convene Sancroft, St. Paul's - London

🛠️ 27 June | Virtual Workshop
• What Supply Chain Risks Are Hidden in Your Helm Charts? — A hands-on deep dive into vulnerabilities, attack scenarios, and best practices for securing Helm charts, ensuring supply chain security and compliance.

👉 Learn more & explore our sessions: https://t.co/Ev118HFRW8

#PlatformEngineering #PlatformCon25 #ArtifactManagement

[Cloudsmith @cloudsmith]

QA ≠ Admin

Developer ≠ Release Manager

Strong Pipeline-Based Access Controls (PBAC) rely on separating duties across the pipeline: https://t.co/QYWOjNKCvo

Download a full guide on OWASP’s CI/CD Top 10 risks: https://t.co/77pCbZWUYP

#PBAC #OWASP #CI/CD

[grlx / stateful server enjoyer (same thing) @gogrlx]

Happy to announce grlx is now being built and distributed with @GoReleaser ! In addition to our official alpine packages, we are now offering aur packages for archlinux as an official distribution channel.

.deb and .rpm packages are coming soon on @cloudsmith

[Cloudsmith @cloudsmith]

Look familiar?

If you’d like a refresher on best practices for tackling Poisoned Pipeline Execution, we’re running through OWASP’s CI/CD Top 10 risks with advice on how to deal with these types of unauthorised executions.

Check out Part 4: https://t.co/kNJYMURVAZ

Download the free guide: https://t.co/i383aZOnMt

[Cloudsmith @cloudsmith]

Is vibe coding more of a risk than a vibe?

“Without security-aware tooling or policy enforcement, enterprises could end up unknowingly introducing vulnerabilities.” — said Nigel Douglas to The New Stack.

Read more: https://t.co/LHAykOMe41

[Cloudsmith @cloudsmith]

“We wanted a product that was easy to use and hard to misuse.”

🎥 Listen to our CTO Lee Skillen discuss the mindset behind building for critical use: simple, secure, and cloud-native from day zero.

[Cloudsmith @cloudsmith]

To help you combat the rise in seemingly harmless malicious packages, we’ve broken down some best practices in Part 3 of the Cloudsmith and OWASP CI/CD Top 10 series on Dependency Chain Abuse.

Read the blog: https://t.co/105trwTIzz

Download the free guide: https://t.co/i383aZOnMt

[Cloudsmith @cloudsmith]

If you’re looking to reduce exposure from over-permissive roles, stale access, or shared credentials, reviewing identity and access management best practice could make all the difference.

In Part 2 of our OWASP CI/CD Top 10 series, we’re looking at CICD-SEC-2: Inadequate Identity and Access Controls.

Read the blog: https://t.co/U18WjT4Qro

Download the free guide: https://t.co/i383aZOnMt