Ship trusted software, fast. Cloud-native artifact management for the AI era — security enforced before packages reach your build environment.
The Cloud (obviously)
Joined October 2015
- Tweets1.4K
- Following613
- Followers1.1K
- Likes2K
We’re bringing the après vibes to #KubeCon 🏔️
Join @awscloud, @ClickHouseDB, @Follow_our_Echo, @EndorLabs, @sentry and @Tailscale for an all-request dueling piano show, dinner, drinks, and a night with the cloud-native community.
Save your spot! luma.com/apreskube-slc
Setup done. The only thing missing is you. If you're at #KubeCon, come say hi and try your hand at some software supply chain trivia.
1
53
NEW: Ensure every agent pulls the same approved skills, with the same controls and audit logs you already use for packages and containers.
24
Can you spot a supply chain threat, tackle a compliance question, and name that package format? Put your #cloudnative knowledge to the test with trivia at Cloudsmith’s booth during #KubeCon + #CloudNativeCon for a chance to win a Keychron V1U 8K keyboard 💥
1
55
#KubeCon North America is just around the corner, and with so many sessions to choose from, do you know where to start?
We curated a list of 13 sessions that should appeal to platform, DevOps, and security teams. cloudsmith.com/blog/13-kubec…
3
66
#GitHubUniverse is nearly a wrap. VP of Product Alison Sickelka shares her take-aways from the week
1
1
61
Come for the coffee, stay to talk about secure artifact management. Find us in the Festival Pavilion at #GitHubUniverse today and tomorrow.
1
94
Caffeine pick me up?
Game of Pipe Runner?
Chat about dependency management?
Swing by and say hi to the #GitHubUniverse Cloudsmith crew 👋
1
68
Your AI agent just ran npm install in its own sandbox. Did it go through your registry or straight to public npm? cloudsmith.com/blog/secure-t…
1
41
Going to #GitHubUniverse next week? We'll be partying with @Tailscale @chainguard_dev @Eficode and @OctopusDeploy on Wednesday night. See ya there? luma.com/git-together
1
56
LiteLLM 1.107.0 on PyPI is compromised. It runs a credential stealer on Python startup that targets cloud keys, SSH keys, and AI provider API keys. If you installed it, remove it and rotate those secrets. How to check exposure: cloudsmith.com/blog/litellm-…
1
60
“We spy Cloudsmith at 34"
Proud to represent Northern Ireland on the financial times list of the UK’s fastest growing companies ➡️ ft.com/content/92195205-ac56…
1
46
A look at everything we shipped in Q3 2026, from automatic OIDC credential discovery in the CLI to a standalone CLI binary with no Python dependency, Nix support, package logs, and more. 🚀
cloudsmith.com/blog/everythi…
1
47
73% of engineers we surveyed trust their tooling to stop an install-time attack before an advisory exists.
But... only 38% scan before ingestion and 24% enforce cooldown policies automatically.
cloudsmith.com/campaigns/dep…
1
54
"do you actually protect yourself from supply chain attacks or do you just hope that you do?" @JMMatchett speaks with the team at Open Source Security on the rise in dependency attacks opensourcesecurity.io/2026/2…
1
42
Scan results are only valid until the next CVE is published, and about 234 are published every day.
See how continuous risk detection is a viable alternative cloudsmith.com/blog/how-cont…
1
49
New CVEs get published about 234 times a day. Scan time grows with packages × advisories since the last scan, so scans run on a schedule and lag.
Matching is a lightweight lookup, so scanners can run continuously as advisories come out.
cloudsmith.com/blog/how-cont…
1
37
There's a real gap between intent and capabilities for stopping the latest onslaught of dependency attacks. Thanks for helping to share some of the research we did @devopsdotcom
A Cloudsmith survey found 73% of platform and security engineers lack strong confidence that their existing tools can prevent software supply chain attacks.
Read more: buff.ly/vxOE53o
#SoftwareSupplyChain #DevSecOps #Cybersecurity #SBOM #Cloudsmith
We’ve joined @chainguard_dev's Athena as a mitigation partner. @alancarson shares why.
Open source registries changed how the world builds software. Protecting them as trustworthy, shared infrastructure, especially as they come under growing pressure from AI-powered threat actors, is a team sport.
Here’s to a safer open source ecosystem for every developer 🤝
Athena's coalition is growing today with new shield and surface partners: @Ahead, @ApiiroSecurity, @cloudsmith, @hcltech, @manifestcyber, @OligoSecurity, @PaloAltoNtwks, @ReversingLabs, @trysurfai, and @sysdig
Shield partners turn Athena's vulnerability and patch data into mitigations like firewall rules and exploit blocking. Surface partners flag vulnerable software in an organization's stack and show how to fix it. Together, these partners help close the gap between a fix existing and a fix being deployed.
Learn more: chainguard.dev/unchained/ath…
