Cloudsmith (@cloudsmith) / X

Cloudsmith

1,341 posts

Cloudsmith

@cloudsmith

Ship trusted software, fast. Cloud-native artifact management for the AI era — security enforced before packages reach your build environment.

The Cloud (obviously)

Joined October 2015

Cloudsmith
@cloudsmith
Jul 14
Attackers didn't need a fake package this time. They hijacked #AsyncAPI's own CI/CD pipeline and shipped the malware through the real one – 2.9 million weekly downloads before anyone caught it. Full attack breakdown:
Inside the AsyncAPI npm supply chain attack
From cloudsmith.com
Cloudsmith
@cloudsmith
Jun 29
Every container inherits its base image. If that image carries unpatched CVEs, your app does too, before you've written a line of code. Here's how to make @wiz_io WizOS hardened images the frictionless default across your org.
Start secure, stay secure with WizOS and Cloudsmith
From cloudsmith.com
Cloudsmith
@cloudsmith
Jun 18
Cloudsmith is now a @github secret scanning partner. If your API key ends up in a public repo, GitHub catches it and tells us. One more layer of control over your software supply chain 🛡️
Secret scanning updates - June 2026 - GitHub Changelog
From github.blog
Cloudsmith
@cloudsmith
Jun 17
The logic is rather simple: if you can compromise the framework itself, you have the ability to compromise highly sensitive infrastructure. Today, it's happened again - this time #Mastra was the target. Full attack breakdown:
Inside the Mastra npm supply chain attack
From cloudsmith.com
Cloudsmith
@cloudsmith
Jun 16
Automate now > explain to regulators later. 87 days until the CRA's 24-hour reporting rule kicks in. We broke down what engineering teams should be working towards for compliance.
The EU Cyber Resilience Act: What Engineering Teams Need to Do to Be Compliant
From cloudsmith.com
See @cloudsmith's full profile
Sign up
Log in

See @cloudsmith's full profile

See @cloudsmith's full profile