Cloudsmith

Ship trusted software, fast. Cloud-native artifact management for the AI era — security enforced before packages reach your build environment.

[Cloudsmith @cloudsmith]

LiteLLM 1.107.0 on PyPI is compromised. It runs a credential stealer on Python startup that targets cloud keys, SSH keys, and AI provider API keys. If you installed it, remove it and rotate those secrets. How to check exposure: https://t.co/mnVXFHTBlF

[Cloudsmith @cloudsmith]

“We spy Cloudsmith at 34"
Proud to represent Northern Ireland on the financial times list of the UK’s fastest growing companies ➡️ https://t.co/NohUfsnDQx

[Cloudsmith @cloudsmith]

A look at everything we shipped in Q3 2026, from automatic OIDC credential discovery in the CLI to a standalone CLI binary with no Python dependency, Nix support, package logs, and more. 🚀
https://t.co/lXg6qHZewW

[Cloudsmith @cloudsmith]

73% of engineers we surveyed trust their tooling to stop an install-time attack before an advisory exists.

But... only 38% scan before ingestion and 24% enforce cooldown policies automatically.

https://t.co/oLXxm9fSPB

[Cloudsmith @cloudsmith]

"do you actually protect yourself from supply chain attacks or do you just hope that you do?" @JMMatchett speaks with the team at Open Source Security on the rise in dependency attacks https://t.co/4Ju7JV2Zjt

[Cloudsmith @cloudsmith]

Scan results are only valid until the next CVE is published, and about 234 are published every day.

See how continuous risk detection is a viable alternative https://t.co/2pHt4td7YZ

[Cloudsmith @cloudsmith]

New CVEs get published about 234 times a day. Scan time grows with packages × advisories since the last scan, so scans run on a schedule and lag.

Matching is a lightweight lookup, so scanners can run continuously as advisories come out.

https://t.co/2pHt4tdFOx

[Cloudsmith @cloudsmith]

There's a real gap between intent and capabilities for stopping the latest onslaught of dependency attacks. Thanks for helping to share some of the research we did @devopsdotcom

[DevOps.com @devopsdotcom]

A Cloudsmith survey found 73% of platform and security engineers lack strong confidence that their existing tools can prevent software supply chain attacks.

Read more: https://t.co/pp8tjacUsO

#SoftwareSupplyChain #DevSecOps #Cybersecurity #SBOM #Cloudsmith

[Cloudsmith @cloudsmith]

We’ve joined @chainguard_dev's Athena as a mitigation partner. @alancarson shares why.

[Cloudsmith @cloudsmith]

Open source registries changed how the world builds software. Protecting them as trustworthy, shared infrastructure, especially as they come under growing pressure from AI-powered threat actors, is a team sport.

Here’s to a safer open source ecosystem for every developer 🤝

[Chainguard ⛓️ @chainguard_dev]

Athena's coalition is growing today with new shield and surface partners: @Ahead, @ApiiroSecurity, @cloudsmith, @hcltech, @manifestcyber, @OligoSecurity, @PaloAltoNtwks, @ReversingLabs, @trysurfai, and @sysdig

Shield partners turn Athena's vulnerability and patch data into mitigations like firewall rules and exploit blocking. Surface partners flag vulnerable software in an organization's stack and show how to fix it. Together, these partners help close the gap between a fix existing and a fix being deployed.

Learn more: https://t.co/j8uKDNPr3g

[Cloudsmith @cloudsmith]

Axios. LiteLLM. Shai Hulud. All hit the same way. Here's how a control point at ingestion, policy-as-code, and continuous risk detection build a supply chain you can actually trust in 2026. Full breakdown ⬇️ https://t.co/gvGQjJOIXp

[Cloudsmith @cloudsmith]

🚀 Now live: policy management and continuous risk detection, open to everyone on Cloudsmith. Write the rules once and enforce them at the repo level, across every pipeline and every developer and agent pulling code in. See it in action. https://t.co/vuY4pxguyS

[Cloudsmith @cloudsmith]

Most security tools find problems after they're already in your environment. A dependency firewall catches them at the door before a bad package ever reaches a build. Here's what that actually looks like.
https://t.co/qovQUm85FF

[Cloudsmith @cloudsmith]

Kubernetes 1.37 drops August 26. Nigel from our team broke down everything worth knowing: new features, deprecations, and the DRA/AI stuff before it even ships. https://t.co/Y2yvhcfPHh

[Cloudsmith @cloudsmith]

Malicious versions of #keyv and #cacheable are spreading through npm on their own; the payload runs on install, steals credentials, then uses them to infect more packages. 444 packages have been hit so far.
https://t.co/2fBw4RyV8S

[Cloudsmith @cloudsmith]

Attackers didn't need a fake package this time. They hijacked #AsyncAPI's own CI/CD pipeline and shipped the malware through the real one – 2.9 million weekly downloads before anyone caught it. Full attack breakdown: https://t.co/aV402W4iDv

[Cloudsmith @cloudsmith]

A look at everything we shipped in Q2 2026, from connected repositories and policy automation to upstream improvements, package recovery, and more: in Q2🚀
https://t.co/v5tn35KNvG

[Cloudsmith @cloudsmith]

Every container inherits its base image. If that image carries unpatched CVEs, your app does too, before you've written a line of code. Here's how to make @wiz_io WizOS hardened images the frictionless default across your org.
https://t.co/uUFZ0RP4fw

[Cloudsmith @cloudsmith]

Cloudsmith is now a @github secret scanning partner. If your API key ends up in a public repo, GitHub catches it and tells us. One more layer of control over your software supply chain 🛡️ https://t.co/oMQ3WwMOmH

[Cloudsmith @cloudsmith]

The logic is rather simple: if you can compromise the framework itself, you have the ability to compromise highly sensitive infrastructure. Today, it's happened again - this time #Mastra was the target. Full attack breakdown: https://t.co/QVQ5BOLvnA