By submitting this form, you agree to our 

Answer twenty questions about your artifact and supply chain practices. Get a custom report card showing your maturity score against key regulatory and compliance frameworks.

Artifact Security Maturity Assessment

We just released the Cloudsmith CLI GitHub Action. This new GitHub Action simplifies the process of installing and pre-authenticating the Cloudsmith CLI using OpenID Connect (OIDC) or an API Key. Whether managing packages, pushing artifacts, or automating your CI/CD workflows, this action is designed to streamline your experience and enhance your productivity.

1. Easy Installation of Cloudsmith CLI 📦

With this GitHub Action, you can effortlessly install the Cloudsmith CLI in your workflows. No more manual installations or complex setup processes. Simply add the action to your workflow, and the CLI will be ready to use.

One of the standout features of this action is its ability to pre-authenticate the Cloudsmith CLI using OIDC. By leveraging OIDC, you can securely authenticate without the need to manage API keys. This is particularly useful for organizations that prioritize security and want to minimize the exposure of sensitive credentials.

3. Support for API Key Authentication 🔑

In addition to OIDC, the action also supports authentication using an API Key. This provides flexibility for users who prefer or require API Key-based authentication. You can easily switch between authentication methods based on your needs.

The action comes with several customizable inputs, allowing you to tailor the setup to your specific requirements. You can specify the CLI version, provide the OIDC namespace and service slug, set the API Key, and more. This level of customization ensures that the action fits seamlessly into your existing workflows.

5. Seamless Integration with GitHub Actions 🤝

Designed to work seamlessly with GitHub Actions, this action integrates smoothly into your CI/CD pipelines. Whether you are building, testing, or deploying, the Cloudsmith CLI GitHub Action enhances your workflow automation and efficiency.

Ready to enhance your GitHub Actions workflows with the Cloudsmith CLI? Check out the 

 for more details and start integrating the action into your projects today.

For more information on Cloudsmith and its features, visit the 

For any questions or feedback, feel free to open an issue on the 

 or reach out to the maintainers. Thank you for your support!

Bartosz Blizniak

Senior Support Engineer

Announcing the Release of Cloudsmith CLI GitHub Action 🚀

It’s no surprise that AI is rapidly becoming the most powerful tool for developers. The ease of use and accuracy of such tools can even generate code snippets for a website written entirely on a napkin! While the potential of AI is exciting, it is crucial to address the potential vulnerabilities that bad actors can exploit within AI systems.

Regardless of the scale of a development project, whether it's a school assignment or a large-scale corporate venture involving multiple developers, they will all have one thing in common, packages! These can range from your usual NPM or Python packages to your core infrastructure servers running Linux that utilize RPM/DEB packages.

Potential Vulnerabilities: Exploiting AI Systems for Malicious Purposes


Bad actors have already found a way to exploit ChatGPT for software supply chain attacks, leveraging the service to introduce malicious packages into various systems. These packages may possess critical known vulnerabilities, be discontinued, or be deliberately crafted as malicious entities while still providing the functionality that the developer needs, avoiding suspicion. By manipulating data from various popular online sources, they can propagate false positive information about specific packages and their functionality. Particularly challenging is the fact that ChatGPT's training data is limited to a specific timeframe, leading to potential nightmares for large organizations progressively integrating ChatGPT into their development workflows.

To illustrate these risks, let's consider a simple scenario in which I asked ChatGPT to create a Node.js application for displaying local weather information:

From the provided screenshot, we can see that ChatGPT's initial instruction is to install package dependencies from NPM. While these packages may seem safe at first glance (They are!), their future integrity cannot be guaranteed due to ChatGPT's inability to verify their safety beyond its training data.

Understanding the Impact of Outdated Training Data

Notably, as of the publication of this blog, the free version of ChatGPT relies on data from September 2021, rendering it two years outdated. This poses a significant concern for packages that frequently receive security updates.

Interestingly, the command suggested by ChatGPT allows for the installation of the most recent version of a package, provided no specific version is specified. This proves beneficial for packages actively maintained and supported by the community. Nevertheless, for packages with limited maintenance or a history of security vulnerabilities, this approach exposes users to substantial risks, and providing the latest version wasn't always the case during my testing. For older projects where the dependencies are harder to update, the suggestions may include a specific version of a package that can be vulnerable.

The absence of real-time data access restricts ChatGPT's awareness of the latest updates or security patches released for packages. Consequently, users become vulnerable to potential security breaches. Malicious actors can exploit outdated packages by injecting malevolent code, thereby leading to devastating consequences such as data breaches, system compromises, or complete takeover of affected systems.

Enhancing Package Security with Cloudsmith

To mitigate this risk, Software as a Service (SaaS) solutions like Cloudsmith provide invaluable assistance. Cloudsmith offers a comprehensive package management solution, centralizing and securing the storage, management, and distribution of software packages.

By leveraging Cloudsmith, developers gain superior control over the packages integrated into their applications. Instead of relying solely on ChatGPT's recommendations, developers can actively scrutinize and verify the packages' authenticity, ensuring they originate from trusted sources. Even if the developer still decides to copy and paste the instructions from ChatGPT, an organization utilizing Cloudsmith will ensure that the packages are pulled through Cloudsmith, ensuring security throughout the entire organization.

Cloudsmith also offers advanced features such as package vulnerability monitoring and real-time alerts through webhooks. Through continuous scanning of packages within its repository, Cloudsmith identifies known vulnerabilities, enabling developers to remain informed about potential security risks. Consequently, even if ChatGPT suggests a package with security vulnerabilities, Cloudsmith can promptly flag it and notify developers to take appropriate action.

The potential consequences of relying solely on ChatGPT's recommendations for package installation become even more apparent when considering the dynamic nature of the software development landscape. New vulnerabilities and security patches are regularly discovered and released, rendering even recently installed packages potentially obsolete or vulnerable. The absence of real-time data access restricts ChatGPT's awareness of these updates, leaving users exposed to potential security breaches. This highlights the critical importance of staying up to date with the latest information on package vulnerabilities and security patches.

Proactive Measures: Automated Vulnerability Monitoring and Real-Time Alerts

Fortunately, there are proactive measures that developers can take to mitigate these risks. One such measure is to implement automated vulnerability monitoring and real-time alerts within the development workflow. By integrating tools like Snyk or WhiteSource into the package management process, developers can receive immediate notifications when a package used in their project is discovered to have a vulnerability. These alerts enable developers to take swift action, such as updating to a patched version or finding an alternative package, thus minimizing the window of opportunity for attackers.

Developers should prioritize establishing a culture of security within their organizations. This includes fostering a mindset of continuous learning and staying informed about emerging security threats and best practices. By investing in regular training and knowledge-sharing sessions, developers can strengthen their understanding of secure coding practices, vulnerability management, and the potential risks associated with AI-powered tools. Ultimately, a well-informed and security-conscious development team is better equipped to identify and mitigate potential vulnerabilities introduced by AI systems.

In conclusion, while ChatGPT's lack of access to live data poses the risk of receiving outdated or vulnerable packages, incorporating robust package management practices and utilizing SaaS tools like Cloudsmith significantly mitigate this risk. By prioritizing stringent package vetting and harnessing tools that provide real-time security insights, developers can enhance the security and integrity of their software projects.

ChatGPT: Friend or Foe? Protect your dev team from the Dark Side!

The team at Cloudsmith is always looking for ways our customers and community can leverage adjacent technologies within the DevOps and application development ecosystem to secure the software supply chain. Cloudsmith developed the first 

, the Cloud Monitoring as a Service solution, a few years ago! That integration was the first step in helping the community leverage both solutions simultaneously, strength for strength. We are excited to introduce the latest enhancement to the community integration, 

 describing the integration between Datadog and Cloudsmith and how it allows developers to monitor the health and performance of their software packages by highlighting the most common metrics, all from the Datadog UI. The initially supported metrics are detailed below:

, the discussion covered a variety of topics but some of the overarching themes were reducing complexity and security. These themes are popular amongst developers, and Cloudsmith is committed to building meaningful solutions for our great customers and community. The next step in this journey is providing additional Cloudsmith visibility in Datadog.

Cloudsmith Vulnerability Scanning will automatically scan supported package types for CVEs upon package upload. As you can see from the image above, all results from this capability can now be seen via the Datadog dashboard. This is in addition to existing capabilities within the Cloudsmith Web UI, the 

. The Cloudsmith Security Scan drives other actions including 

, preventing users and systems from downloading the compromised package.

The audit logs feature allows you to monitor all activity performed by the system, users or services in Cloudsmith, including creating or deleting a repository, modifications to repository settings, package deletions and quarantines, and more. Now alerts can be set up in Datadog based on the audit log data to receive notifications when suspicious activity is detected.

The addition of vulnerability scanning and audit logs to the Datadog-Cloudsmith integration provides developers with even more tools to monitor the health and security of their software packages. One of the biggest challenges developers and teams are struggling with is tooling or screen fatigue. By combining these features with Datadog's monitoring capabilities, developers can stay on top of any issues and ensure their packages are secure and reliable within the tool or screen that makes the most sense to them.

For the initial setup instructions for the Datadog-Cloudsmith integration, please refer to our 

Datadog Integration Update: Vulnerability Scanning and Audit Logs

Customers can now integrate Cloudsmith with Roadie, letting users monitor key Cloudsmith data within the Roadie developer portal.

Cloudsmith has just announced an exciting new integration with 

, a start-up that provides SaaS for Backstage, a service catalog open-sourced by Spotify that automatically tracks your microservices. Organizations use Roadie to build a software catalog and developer portal for internal systems, centralizing information in one convenient location.

We know how frustrating it can be to track down what systems are used for what and monitor information and logs from those various systems. That's why we're thrilled to announce customers who use Roadie can now add Cloudsmith data to their dashboards. This will make it easier for users at an organization to quickly see what teams are using Cloudsmith, and key data about their Cloudsmith account.

Let's run through how to set up the integration between Cloudsmith and Roadie. The good news is it's quick and easy to do!

First, you'll need to visit the Roadie Backstage Plugins repository on 

, as well as instructions on how to install and configure it. Follow these steps, and you'll have the integration set up in no time.

Once you've installed the plugin, you can start using Roadie to monitor your Cloudsmith account. If you need help getting started, you can check out the documentation on the Cloudsmith 

. Here, you'll find further detailed instructions on how to use the integration.

With this integration, you can simplify the process of keeping tabs on your package management services. You'll have all the information you need in one convenient location, without having to log in to multiple apps. So, don't wait any longer, connect your Cloudsmith account with Roadie today and enjoy the convenience it offers you!

Cloudsmith Blog

Announcing the Release of Cloudsmith CLI GitHub Action 🚀

ChatGPT: Friend or Foe? Protect your dev team from the Dark Side!

Datadog Integration Update: Vulnerability Scanning and Audit Logs

Integrating Cloudsmith with Your Roadie Developer Portal