Cloudsmith

@cloudsmith

Ship trusted software, fast. Cloud-native artifact management for the AI era — security enforced before packages reach your build environment.

The Cloud (obviously)

cloudsmith.com

Joined October 2015

613 Following

1,109 Followers

Replies Reposts Media

Cloudsmith
@cloudsmith
Oct 13
A look at everything we shipped in Q3 2026, from automatic OIDC credential discovery in the CLI to a standalone CLI binary with no Python dependency, Nix support, package logs, and more. 🚀
Everything Cloudsmith shipped in Q3 2026
From cloudsmith.com
Cloudsmith
@cloudsmith
Oct 6
73% of engineers we surveyed trust their tooling to stop an install-time attack before an advisory exists. But... only 38% scan before ingestion and 24% enforce cooldown policies automatically.
Dependency attacks 2026: The confidence gap
From cloudsmith.com
Cloudsmith
@cloudsmith
Oct 6
"do you actually protect yourself from supply chain attacks or do you just hope that you do?" @JMMatchett speaks with the team at Open Source Security on the rise in dependency attacks
Dependency attacks in 2026 with James Matchett
From opensourcesecurity.io
Cloudsmith
@cloudsmith
Oct 6
Scan results are only valid until the next CVE is published, and about 234 are published every day. See how continuous risk detection is a viable alternative
How continuous risk detection replaces point-in-time scans with real-time monitoring
From cloudsmith.com
Cloudsmith
@cloudsmith
Oct 5
New CVEs get published about 234 times a day. Scan time grows with packages × advisories since the last scan, so scans run on a schedule and lag. Matching is a lightweight lookup, so scanners can run continuously as advisories come out.
How continuous risk detection replaces point-in-time scans with real-time monitoring
From cloudsmith.com