By submitting this form, you agree to our 

Answer twenty questions about your artifact and supply chain practices. Get a custom report card showing your maturity score against key regulatory and compliance frameworks.

Artifact Security Maturity Assessment

On August 4, 2026, a self-propagating worm began 

publishing malicious versions of the npm packages keyv and cacheable

, is still developing as we publish, and the list of affected 

 packages has grown through the day to 2,236 package versions. Below we cover what we know so far, how to check whether your organization is exposed, and the controls that stop this class of attack from reaching your builds.

Beginning around 10:53 UTC on August 4, an attacker started pushing malicious releases to legitimate, well-established 

 packages. We know these were not a set of newly published typosquatted packages; the attacker is publishing new 

 of real packages that teams already depend on.

The scale of this attack is significant - tracking so far points to roughly 

 published across them. Several packages received a dozen or more malicious versions in a matter of hours, and new versions were still appearing past 13:20 UTC.

The affected packages sit deep in the JavaScript dependency graph. 

 are transitive dependencies of a large range of common tooling, so most teams that install them never explicitly chose them directly. Weekly download volume for some of these packages rivals the most popular libraries on 

, which gave the campaign a very large potential blast radius.

The activity carries the hallmarks of the 

. The malicious payload is delivered through install-time lifecycle (preinstall) scripts. Once executed on a developer or CI machine, it harvests credentials and tokens and uses any recovered 

 publish tokens to push malicious versions to other packages the compromised account controls. That self-propagation is why a handful of initial compromises turned into hundreds of packages within hours.

It’s also important to note that if you’re running 

, released roughly a month ago, it no longer runs lifecycle scripts by default. Organizations that have upgraded and not re-enabled script execution are substantially protected even if a malicious version was pulled, because the payload never runs on install. However, teams still on older 

 clients, or that have explicitly enabled install scripts, do not have that inherent protection.

Exposure comes down to two questions: did you install an affected version, and could it run on install?

 Compare the packages and versions in your lockfiles (

 against the current indicators. Community trackers are maintaining live lists; the tagged dataset at 

 are both being updated as the campaign expands. Because the affected set is still growing, treat any single snapshot as a lower bound and re-check.

Match on whole package names, not substrings.

 When scripting your own checks, anchor on exact package names. Loose substring matching produces false positives (for example, flagging an unrelated package that merely contains an affected name as a fragment) and wastes triage time.

 The malicious versions were published in a bounded window on August 4. A version of an affected package that predates that window is not part of this campaign. Confirm the specific version, not just the package name.

Check whether install scripts can execute.

 client version and whether lifecycle scripts are enabled in your environments. If you are on 

 with scripts disabled by default, an affected version that was pulled but never executed represents materially lower risk.

 If a malicious version could have run in a developer or CI environment, rotate 

 tokens, cloud credentials, and any secrets that were reachable from that environment, and review recent publish activity on your own packages.

Search your Cloudsmith registry for any cached versions & quarantine. 

If your organization doesn’t have a cooldown or malware policy in place, there's a chance a malicious version was already requested by a developer or pipeline and cached in Cloudsmith - search for any affected versions and quarantine them.

If you find only pinned references in old, dormant projects, the immediate risk is usually low, since a locked dependency tree will not pull a new malicious version on its own. The real exposure is a fresh install or a lockfile refresh that resolves to a compromised version.

This attack is just another example of why pulling directly from a public registry into your builds is a risk worth removing. Cloudsmith sits between the public registry and your developers and pipelines as a single, policy-enforced control point, which changes the outcome in three ways.

While there are many client-side cooldown solutions built into native package managers, this can often be difficult to manage at scale for enterprises. Regardless of client version or script settings, Cloudsmith moves enforcement to the server-side by removing newly published upstream versions for a defined window before they become installable. Attacks like this one depend on speed: a malicious version is published and pulled into builds within minutes or hours, then withdrawn. 

 means those versions are never served to your teams during the window when they are most dangerous, buying time for the ecosystem to flag and remove them.

 Packages flowing through Cloudsmith are scanned for malware and also matched against our comprehensive database of malware advisories. With 

, you can define policies that block versions flagged as malicious or matching known indicators. When a package is identified as compromised, the policy stops it from being distributed to any consumer behind Cloudsmith, without waiting for every developer to update a manual blocklist.

 Because installs resolve through Cloudsmith rather than directly from the public registry, you get one place to enforce controls, one audit trail of exactly what entered your environment, and the ability to answer "were we exposed?" from your own records instead of reconstructing it across every machine and pipeline. Cooldown and malware policies only protect what actually routes through them, so 

 is ensuring your package installs go through the proxy rather than reaching upstream directly.

By applying these safeguards in Cloudsmith, you can greatly reduce the likelihood of being affected by the frequent supply chain attacks we are seeing across the open source ecosystem.

Cristian Garcia

Senior Customer Success Manager

Keyv and Cacheable npm packages compromised in active supply-chain attack

If time’s just a construct of human perception, does that mean all package managers interpret time differently? And what does that have to do with cooldown policies?

 help protect your software supply chain from zero-hour threats by holding packages for a set period of time to allow threat intelligence to catch up. But where does a package get held, and how does that impact how you configure your cooldown policy?

You can implement cooldown controls on either the client-side and on the server-side. This post highlights the difference between where the cooldown policy lives, and how that impacts your ability to implement and scale that policy. We’ll explore how they can be defined differently in various ecosystem package managers, and why all this flexibility actually might hinder (not help) the security posture of our software supply chain.

JavaScript developers most commonly pull 

 registry. The most popular Javascript package manager, 

, included the concept of a minimum release age (

 represents the number of days a dev must wait before they can receive a newly-released software dependency, as a single number unit. However, not all JavaScript package managers work the same way. The 

 client, for example, chose a completely different unit of time. We can see that 

 specifically treats cooldown (within the 

 registry also introduced the cooldown field 

) represents the configured cooldown period in 

) supports days and weeks in a more humanly-readable approach, similar to 

This leaves JavaScript teams in a situation where securing a polyglot Node.js environment requires a math degree and a cheat sheet! If your team wants to implement a cooldown policy and uses a mix of 

 (as only a few examples), you need to translate a basic 48-hour quarantine policy into days, minutes, seconds, and human-readable string tags simultaneously. This arbitrary config drift is more than a tedious task, it’s a genuine security liability. When security policies are this fragmented across tools running in the same language ecosystem, misconfigurations are more likely.

The Python ecosystem is similar to JavaScript when it comes to representations of time. Astral’s 

 package manager provided cooldown controls in 

. It uses relative durations, but also supports a bunch of other duration formats (inside 

The result in the Python ecosystem is a case of duplicate standards. While more modern, lightning-fast tools like 

 embrace highly flexible relative text strings, standard 

 leans heavily into the rigid syntax of ISO 8601. For security teams trying to enforce a consistent supply chain guardrail across a variety of developer endpoints and pipelines, this introduces a layer of translation friction. We aren't simply configuring the time window, we’re also managing entirely different syntactical philosophies from what was discussed in the JavaScript ecosystem - just to keep a volatile package at bay.

Package Managers with no support for Cooldown Policies

And that brings us to the lack of support for cooldown policies in many other popular language ecosystems. As of the time of writing, languages like 

 provide client-side support for cooldown controls in any direct configuration field.

In the absence of built-in cooldowns, devs without server-side or private artifact repository solutions rely on strict version pinning as their primary line of defence. But version pinning is a double-edged sword:

Pinning to an older version should (generally speaking) keep you safe from a zero-day compromise in today's release, but it leaves you exposed to older, known CVEs.

Pinning only works if you trust the version you are pinning. If you update your config to pin a newly released version and that version happens to be a compromised release from a hijacked maintainer account, well then, your client will happily download and index that malware regardless.

Without a cooldown policy acting as a quarantine buffer, devs updating their pinned dependencies are essentially playing Russian roulette with the latest release.

On a positive note, the open source supply chain is evolving all the time. Where cooldown controls don't exist today, they could very well exist tomorrow. What’s important to software developers and security teams is that we can curate or enforce security controls that seamlessly apply across the wide variety of languages and runtime ecosystems.

That’s where an artifact management platform like Cloudsmith comes to the rescue. The platform provides cooldown policy support for 

, with additional format support planned:

Cloudsmith supports cooldown policies in npm and Python

If time really is just a construct of human perception, package managers have certainly taken that philosophy to heart. But the real headache is trying to actually implement security controls in the real world. 

This is fundamentally a client-side crisis

We are forcing devs and their pipelines to rely on local, fragmented CLI tooling to enforce security policies that should be uniform. The fragmentation here is a massive vulnerability:

Different naming conventions and arbitrary time units across clients make universal configurations very challenging.

Some client-side tools allow granular exclusions, while others offer no cooldown protection at all.

While centralised registries like Cloudsmith work overtime to curate, scan, and secure upstreams, they need to account for rogue, outdated, or poorly designed local clients that bypass standard safeguards.

Trying to secure a polyglot codebase where the security posture of your entire pipeline is dictated by the weakest client-side tool in your stack is a logistical nightmare.

Cloudsmith solves this systemic headache by providing a single control plane for your entire software supply chain. By defining a universal policy that sits above individual ecosystems, you don’t waste time tweaking configurations across a wide range of runtimes. With Cloudsmith, you define the policy once, and enforce it across your entire workspace.


If you’re interested in learning more about Cloudsmith 

Nigel Douglas

Head of Developer Relations

How to configure time for cooldown policies

If you were hoping for a relaxing summer break without a software supply chain attack, the latest news will disappoint. Early on July 14th 

 identified that an attacker compromised AsyncAPI repositories and used the projects’ own CI/CD pipelines to publish four malicious npm packages. Together these packages see more than 2.9 million downloads a week, with @asyncapi/specs accounting for roughly 2.7 million of them.

Here’s what we know so far, why so many conventional defenses would have let these packages through, and what a governed control layer does about it.

The attacker exploited a misconfigured GitHub Actions workflow in the asyncapi/generator repository to steal a highly privileged token belonging to the project's automation account. They used that token to push a commit that triggered the release pipeline, which published trojanized packages to npm under the trusted @asyncapi namespace. A second repository in the same organization was then used to publish the highest-impact package, @asyncapi/specs.

For a full breakdown of the attack, Wiz’s post provides an excellent 

This attack has two details that matter for what follows. First, the malicious code was hidden inside otherwise legitimate source code and it ran on package import rather than install. Second, once triggered it installed a persistent credential stealer that swept for browser passwords, SSH keys, npm and GitHub tokens, and cloud credentials.

Why security scanners may have allowed these packages through

None of the usual signals a build environment relies on would have stopped these downloads.

 The packages came from the correct namespace, published through the project’s real release pipeline using a real maintainer token.

The versions were brand new, so no intelligence existed yet: 

At the moment of publication, no advisory named these versions as malicious. A team pulling @asyncapi/specs@latest in the minutes or hours after publication would have received a clean bill of health from every feed, because the community hadn't identified the compromise yet. This is the zero-hour window, and pulling directly from a public registry means running straight into it.

Install-time scanning looked in the wrong place:

 Many defenses focus on preinstall and postinstall hooks, because that's where supply chain payloads have historically lived. This payload executed on import instead. Tooling watching only the install lifecycle would have seen nothing.

 Even a developer inspecting the source would have had to scroll past hundreds of blank spaces to find the payload.

This pattern is consistent across many of this summer’s software supply chain attacks. When packages flow directly from a public registry into a build without a control point in between, a compromise can reach your environment because nothing was positioned to intercept it.

Check your lockfiles for the compromised versions

Assume secrets are exposed on any developer machine or CI runner that installed an affected version. Rotate npm tokens, GitHub tokens, SSH keys, AWS access keys, and browser stored credentials.

Audit CI/CD secrets for any pipeline that ran npm install during the compromise window.

The steps above are helpful but reactive, taking place only after a malicious package is already inside your environment. These steps also don’t scale, relying on someone to spot the advisory, trace which builds pulled what, and rotate the right credentials before an attacker uses them.

Artifact management platforms can add a control layer ahead of package pulls to prevent some of these dangers from ever becoming present. Simply put, when detection and response move upstream and run automatically, compromised packages are stopped or contained upstream.

Cloudsmith is that governed control layer. Every package that enters a Cloudsmith workspace, whether proxied from a public registry or published internally, is evaluated against policies that assess risk, and permitted or blocked before it reaches a developer machine or CI pipeline. Two capabilities map directly to how the AsyncAPI attack played out.

With Cloudsmith as a private registry proxying npm, PyPI, Maven Central, and others, npm install routes through Cloudsmith rather than straight to the public registry. Every package, including transitive dependencies, flows through one control point you can see and govern. Without that layer, there's no place to intercept a poisoned @asyncapi/specs on its way into a build.

 to help businesses vet new packages for risk: they set a minimum age a package must reach before it can be used. That closes the window most of these attacks target, the gap between a malicious package going live and an advisory going out, Cloudsmith’s cooldown policies are enforced at the index level. Versions younger than the age you set are filtered out before the package manager ever sees them, with builds resolving cleanly to the next available version.

Cooldown with Cloudsmith this summer. Relax knowing that Cloudsmith checks every open source dependency your team pulls, keeping malware like this out of your artifacts. 

 today about defending against malicious package attacks.




Meghan McGowan

Product Marketing Manager

Inside the AsyncAPI npm supply chain attack

The software supply chain landscape changed forever in early-to-mid 2026. What began as a series of isolated credential-theft incidents quickly mutated into a highly coordinated, multi-registry, self-propagating 

 campaign.

By abusing trusted relationships, hijacking CI workflows, poisoning build caches, and even embedding execution scripts inside compiled native binaries, the threat actors behind this campaign (tracked as 

) bypassed traditional static scanner defences.

As of the time of writing, this is a somewhat complete, chronological teardown of the three distinct waves of this campaign: 

Shai-Hulud, Mini Shai-Hulud and similar worms

The Shai-Hulud worm lineage first surfaced in late 2025 as a direct credential stealer targeting the npm ecosystem. However, on May 11th, 2026, a highly automated, modernised variant called Mini Shai-Hulud struck with vastly expanded scope. While it heavily impacted npm, compromising more than 170 packages across the TanStack, Mistral AI, UiPath, and OpenSearch ecosystems, the worm simultaneously breached the broader software supply chain, orchestrating coordinated attacks against PyPI, RubyGems, Docker Hub, and even malicious extensions within VS Code.

Unlike the earliest waves of Shai-Hulud that relied specifically on stolen static developer credentials, Mini Shai-Hulud (believed to have been created by a different group to TeamPCP), gained entry to these diverse environments via entirely new approaches, like pull request workflow misconfigurations in GitHub Actions (as seen in the 

 compromise).

The basic workflow looked like this. An attacker submitted a pull request from a fork. This triggers a workflow that grants write access to the base repository's cache. The attacker proceeds to poison the cache with malicious payloads. Hours later, a legitimate maintainer merges a commit, triggering the standard release workflow. And this all concludes with the release run pulling the poisoned cache and executing the malicious payload invisibly.

Rather than exposing static tokens, the worm scraped live tokens directly from the GitHub Actions runner’s active memory (the 

). Depending on the target ecosystem, it then exchanged these temporary workflow credentials for registry-specific publish tokens, using OIDC token exchange endpoints for 

, or harvesting raw API keys for RubyGems and container registries like 

.

This allowed the published packages, container images, and extensions to carry valid SLSA Build track provenance signatures. To defenders, the updates appeared completely legitimate and officially attested across all affected registries. It’s the equivalent of deepfakes for the software supply chain.

Perhaps the most malicious aspect of this multi-registry wave was its defence mechanism. Once inside a developer's local machine or build server (whether pulled via a Python 

 package, or a VS Code extension) the payload established a background daemon named 

. This daemon monitored whether its stolen tokens had been rotated or revoked, acting as a dead man’s switch. If a defender revoked the token, the daemon immediately triggered a local script that executed 

, wiping the victim's entire home directory to eliminate forensic traces and punish the developer.

 represents the third evolution of the Shai-Hulud family of worm attacks, compromising hundreds of 

 components (including packages within the 

 namespaces).

In this workflow, a simple 

 command that drops the Miasma payload. Again, the tactics and techniques of this Shai-Hulud worm have changed multiple times so far this year. Most security scanners and manual reviewers focus closely on scripts blocks in 

 triggers).

Miasma bypassed this completely by abusing 

, for context, is a legitimate config file used to compile native C++ Node.js add-ons. When a package containing this file is installed, the npm client automatically spawns 

. The attackers embedded direct command execution wrappers inside the 

 target configs. The system executes the malicious payload during compilation, completely avoiding the need for suspicious 

 lifecycle scripts.

Miasma focused heavily on capturing cloud identities instead of static keys, implementing collectors specifically designed to steal active GCP and Azure SSO credentials. Furthermore, if the infected CI container had access to the host's Docker socket (

), the malware would’ve performed a Docker escape. It identifies and terminates security monitoring containers (such as Step Security’s 

), creating a privileged Alpine container to write passwordless 

, and altered local DNS resolution to block telemetry reporting domains.

Discovered on June 8th, 2026, straight after the Miasma variant, the campaign expanded to the Python ecosystem, targeting critical academic genomics and phenotype analysis packages on 

).

In this attack, a simple Python Import loads a 

 extension which executes embedded javascript. The embedded javascript code executes a final Bun payload which exfiltrates to a GitHub endpoint.

In a major evasion upgrade, the attackers did not modify any Python source files. Instead, they embedded the malicious JavaScript loader inside the compiled Rust/C++ binary extension (

).

When a researcher imports the package via Python (

 file. The shared object discreetly initialises and runs an embedded JavaScript engine to execute the payload. This makes the new attack completely invisible to code-reviewers looking at Python source files.

The payload's primary file, 

, contains a massive block of comment text representing a fake LLM jailbreak prompt. The decoy simulated classified briefings, asking for technical steps on weaponising biological agents and designing nuclear devices. This was a deliberate attempt to pollute static analysers and AI-assisted tooling, causing them to choke, flag false positives on safety boundaries, or even worse, misclassify the file as a prompt-injection experiment rather than a credential-stealing worm.

Instead of a standard server, the Hades variant registered dozens of GitHub repositories using the compromise-controlled user account 

. The repositories used underworld-themed naming conventions (like 

. The exfiltrated data was stored in an encrypted envelope format, signed with GPG keys.

In August 2026, the open-sourced Mini Shai-Hulud codebase was weaponised in one of the most widespread multi-registry campaigns to date. The outbreak began with the compromise of 

's account. This was the primary developer behind popular, heavily downloaded packages like 

.

From this single entry point, the worm exponentially expanded into over 444 packages across 2,000+ published releases, hit 100 packages in the 

 ecosystem alone, and aggressively turned every infected machine into an automated propagation node.

The execution chain relies on the 

 dropper. To evade standard JavaScript static analysis tuned for Node.js patterns, the 

 file detected the host architecture, downloaded a bundled 

 runtime, and proceeded to execute a massive, heavily obfuscated payload named 

.

Rather than stopping at passive credential dumping, this variant actively probed and harvested deeper infrastructure credentials: It actively queried AWS IMDSv2 and ECS endpoints, enumerated AWS SecretsManager paths, read mounted Kubernetes ServiceAccount tokens, and extracted HashiCorp Vault secrets across KV v1 & v2 mounts. It even hunted local crypto wallets like bitcoin wallet files. It was observed that exfiltration calls were routed to a dynamic domain endpoint. Crucially, if the server returned an execute payload in its JSON response, the worm immediately executed it using 

, giving the threat actors live remote code execution on infected dev machines and CI runners. Finally, if the primary C2 server failed, the worm fell back to using stolen GitHub tokens to automatically create public GitHub repos containing base64-encoded stolen data, tagging the repo descriptions with a distinctive campaign marker. This time 

.

To ensure propagation, the worm scraped 

 creds or even exchanged GitHub Actions OIDC tokens to auto-publish patch updates of packages the maintainer controlled. It inserted 

 as an optional dependency, allowing the payload to silently cascade into downstream installs without causing build failures. Furthermore, it even expanded on the infection vectors directly inside dev workflows by writing malicious GitHub Actions workflows disguised with the name 

, as well as altering AI-related dev tooling via poisoned 

Shai-Hulud-style worms will continue to change shape

 or leaking of a complex piece of malware like the Shai-Hulud worm typically triggers a significant shift in the threat landscape. When a sophisticated framework (originally tightly controlled by an advanced group like TeamPCP) becomes publicly accessible, it lowers the barrier to entry for a much wider, more disorganised pool of actors. Independent operators, smaller cybercriminal syndicates, and even security researchers looking to understand its mechanics can dissect the original codebase. This democratisation of advanced tech means that features previously requiring high-level engineering, such as automated supply-chain propagation or complex credential harvesting, become plug-and-play modules for anyone with basic development skills.

Without a centralised command structure like TeamPCP directing its deployment, the evolution of Shai-Hulud has naturally fragmented into highly specialised or experimental variants (such as 

). Newer threat actors are combining Shai-Hulud’s core self-propagating mechanisms with different payloads or evasion techniques tailored to their specific objectives. For instance, some variants strip away the heavier components to create lightweight stealth tools, while others swap out the exfiltration methods to target different developer ecosystems beyond 

. This fragmentation complicates defense strategies, as defenders can no longer rely on a single set of behavioural signatures or specific infrastructure indicators associated with the original group.

Furthermore, this post-TeamPCP era accelerated the timeline of dual-use engineering, where threat actors repurpose and optimise techniques from Shai-Hulud in unexpected ways (as seen in the 

). Independent devs often modify the codebase to patch flaws left by the original authors (such as fixing loud fallback routines or refining how the worm handles OIDC token exchanges). Because these new variants are built and deployed by completely unrelated clusters of users, the attribution of attacks becomes incredibly muddy. The signature architecture of Shai-Hulud is no longer a reliable indicator of 

 is attacking, but rather a reflection of a shared, open-source repository of commodity supply-chain threats. This is glaringly the case with alleged 

If the evolution of Shai-Hulud proves anything, it's that attackers are exceptionally creative and relying purely on reactive remediation is a losing strategy. When malware can pass SLSA attestations, bypass 

 inspection via native builds, and hide inside compiled binaries, you simply cannot predict every vector. It only takes one compromised token to trigger a massive downstream disaster. While rapid incident response remains essential, putting heavy effort into proactive preventions, such as universal package cooldown policies and strict pipeline boundaries is the only way to neutralise these threats before they execute. Stopping the attack at the gate will always be easier than cleaning up the damage after a worm gets through.

If you found this breakdown useful and want to keep up with the evolving threat landscape of malicious dependencies and open-source malware, join our upcoming webinar: 

Inside the Open Source Malware Attack Landscape

) to discuss real-world attack vectors and how to protect your software pipelines.

The evolution of Shai-Hulud-style worms

The tools security teams reach for first inspect code at different points in the development process: at the PR stage, at build time, or monitoring what's running in production. They're solving real problems, and they're good at them. What they don't do is govern which packages are allowed to enter your environment in the first place.

That control happens at the artifact registry, which is the one place every package, team, and pipeline passes through. A scanning tool that runs at PR time sees a dependency after it's already been fetched. A runtime tool sees it after it's deployed. Cloudsmith sits upstream of both: before a dependency reaches a developer, a build tool, or a CI job, Cloudsmith checks against current threat intelligence and uses your policies to clear or block it. The scanning you already have gets cleaner input. Cloudsmith provides the enforcement layer the security stack was missing.

Three capabilities form the foundation of a dependency firewall posture: controlled upstream ingestion, continuous metadata enrichment, and a customizable policy engine. Together they create a control layer that decides what enters your environment automatically and keeps re-evaluating that decision as intelligence updates.

Most security tools evaluate packages after they enter your environment. Cloudsmith governs what's allowed in before a build runs and checks everything in your repositories when new threat intelligence drops. No team has to configure its own pipeline rules to get that coverage. This guide covers upstreams, continuous enrichment, and policy as code built on OPA, from initial configuration through to enforcement.

 route all public registry requests through your Cloudsmith repositories rather than letting build tools pull from registries directly. Every package request resolves through a configured upstream. Cloudsmith fetches each package once and caches it permanently, serving it from your repository from that point forward. When a public registry has an outage, your builds continue.

The security consequence matters more than the availability benefit: you have a single point through which all package traffic flows. Without it, policies can't enforce consistently because downstream rules only catch what passes through them. The upstream is the prerequisite everything else builds on.

 closes dependency confusion attacks at the configuration level, before policy evaluation runs. When you mark a public registry as untrusted, Cloudsmith won't fetch a newer version of a package from that registry if a local version already exists. A higher version number on the public registry doesn't win. An attacker publishing 

. The attack surface closes at configuration, not after detection.

Cloudsmith evaluates every package against the 

 database (which aggregates records from GitHub Security Advisories, the OpenSSF Malicious Packages Project, the NVD, and language-specific datasets), 

 for real-world exploitability, and SPDX license metadata. For Docker images, Cloudsmith generates a full software bill of materials (

The part that separates this from point-in-time scanning: Cloudsmith polls its intelligence sources continuously. When a new advisory is published, Cloudsmith checks every package already in your repositories, not just what arrives after the disclosure. A package that cleared evaluation yesterday can be quarantined today, automatically, without anyone manually triggering a re-scan.

This is the enforcement model that most registries and scanners don't offer. A scan at ingestion tells you whether a package was safe when it arrived. Continuous re-evaluation tells you whether it's still safe now. When new malware signatures drop, or a previously low-severity vulnerability gets weaponized and its EPSS score spikes, Cloudsmith checks your inventory for a match and triggers policy enforcement.

Policy evaluation also runs at package promotion events and when new packages are published, and on a fallback schedule if nothing else has changed.

Cloudsmith's approach to policy management is built on Open Policy Agent (

), the same open standard used in Kubernetes environments and across the cloud-native ecosystem. Policies are written as policy as code in Rego and managed through Cloudsmith's 

, giving you full lifecycle management of rules, precedence, enabled state, and actions as code, all version-controlled alongside the rest of your infrastructure.

Cloudsmith puts policy enforcement, malicious package detection, vulnerability matching, and license governance in one platform, under one policy model. That means policy as code, using OPA and Rego, with structured exception workflows, instead of binary allow/block toggles spread across multiple UIs.

This normalizes package metadata across 30-plus formats, so a single policy as code definition, written in Rego, applies consistently whether you're managing npm packages, Docker images, Maven artifacts, or Python wheels. Policy input includes CVSS scores, EPSS scores, OSV malware identifiers, license type, fixed versions, repository names, uploader identity, build-time tags, and for Docker images, the full component-level SBOM.

Cloudsmith provides policy templates and a 

 to accelerate policy authoring. Every policy evaluation creates a decision log record, which includes the input data, what the policy matched, and which actions ran, giving you the traceability to audit decisions and roll back when needed.

Creating a baseline policy set for a dependency firewall

Four policies form a strong starting point. Each addresses a distinct risk; together they cover the primary ways malicious or non-compliant packages enter a production environment.

 Packages carrying an OSV malware identifier get quarantined across every repository in the workspace – current and future. The coverage is immediate and unconditional, and the signal quality is high enough that there's almost no argument against this policy. Apply it globally, set its precedence to #0 (first), and move on.

 A cooldown is a timed hold for newly fetched packages from public registries, enforced at the index level. Cloudsmith won't download or cache packages within the cooldown window, making them unavailable to build tools. Compromise attacks on trusted packages are typically identified within days of publication. A three- to seven-day hold gives threat intelligence time to catch up before a package reaches a pipeline. When a malware identifier matches during the window, the package gets quarantined. When a package clears the window clean, it downloads, caches, and becomes available automatically. Clean cases need no human decision.

Cloudsmith exposes both the CVSS score and the fixed version in policy input metadata, so policies can distinguish between risk profiles rather than applying a single blanket rule. A package with a 

Cloudsmith Blog

Keyv and Cacheable npm packages compromised in active supply-chain attack

How to configure time for cooldown policies

Inside the AsyncAPI npm supply chain attack

The evolution of Shai-Hulud-style worms

How to use Cloudsmith as a dependency firewall

A dependency firewall gives your scanner better inputs

Dependency attacks start before your scanner runs

Cloudsmith credentials are now detectable by GitHub Secret Scanning

Inside the Mastra npm supply chain attack

How Cloudsmith's cooldown policies stop newly published packages without disrupting your builds

The EU Cyber Resilience Act: What engineering teams need to do to be compliant

The Miasma worm's path of destruction