By submitting this form, you agree to our 

Answer twenty questions about your artifact and supply chain practices. Get a custom report card showing your maturity score against key regulatory and compliance frameworks.

Artifact Security Maturity Assessment

Why we chose it, how we built on it, and where we’re going next

Ensuring the integrity of open source software is a growing priority for organizations of every size. But doing it in a way that doesn’t slow down developers is hard.

We believe the right long-term answer is a curated repository of known-good open source software that is continuously verified, with your organization’s security and compliance policies applied, and deeply integrated into your core workflows.

Cloudsmith is the right place to do this. We’re not just hosting packages; we’re providing the control plane and data plane for the software supply chain. And that starts with how we handle vulnerability data and threat intelligence.

We chose Trivy as the base for vulnerability scanning at Cloudsmith because it’s open source, fast, and widely trusted. 

We integrated Trivy into our cloud-native platform, giving our customers access to 

We’re expanding beyond Trivy, ingesting multiple data sources and ultimately adding pluggable security integrations.

 A curated, secure, resilient software supply chain that keeps developers productive and organizations safe.

 early on, as we were building Cloudsmith. It’s open source, well-supported, and widely trusted. It offers support for containers, OS packages, language dependencies, SBOMs and secrets scanning. It’s also well-maintained; with over 27,000 GitHub stars, millions of downloads, and millions of users, the global developer community clearly values the capability that Trivy provides.

It’s no surprise that Trivy is the default scanner in many other platforms. But integrating it into a cloud-native platform like Cloudsmith, where artifacts are constantly being pushed, pulled and promoted across repositories, meant solving for cloud scale, automation, and extensibility.

Trivy helped us get high-quality results fast. Here’s how we super-charged it for our customers.

Every artifact pushed to or cached through Cloudsmith is scanned automatically, without any manual configuration or setup required. This means security is built into the pipeline from the very first interaction. The scans run in the background, ensuring zero friction for developers while giving teams continuous visibility into security risks.

: Every Docker/OCI image published to Cloudsmith is automatically accompanied by an SBOM in the CycloneDX format. CycloneDX is widely supported across security tools and ecosystems, making it easy to integrate SBOMs into your broader supply chain risk management processes. By leveraging Trivy’s SBOM capabilities, we ensure that every image has a clear and standardized inventory

Because Cloudsmith is a universal artifact management platform, we can centralize vulnerability data for our customers across all of their formats and surface that information to them across their workspace. 

Cloudsmith is designed to work at global scale, so when we integrated Trivy as our scanner, we knew it needed to keep up too. Cloudsmith is 

proven to handle > 1 million requests per minute

 and we execute millions of vulnerability scans as customers add to their repositories.

Quarantine or notify when users are accessing insecure packages using Cloudsmith’s OPA based 

SAML, SCIM, OIDC, logging, and ISO 27001 compliance ensure a 

With Trivy running reliably across our platform, we started rethinking how to keep vulnerability data fresh and actionable.

We ingest CVE data continuously, from Trivy and also from additional sources like 

. And we apply that data to artifacts already in your repositories. That means no need to trigger rescans.

New advisory published? We re-check your existing packages against fresh data.

Define rules using CVSS, EPSS, license metadata or any other detail about your package, and act on them automatically.

 Every match, every decision, and every policy action is logged.

So we can add data sources like OSV.dev and package health signal data.

This turns scanning into a real-time feedback loop, so you can catch new risks as soon as they emerge.

The presence of CVEs isn’t the only signal about the quality of software packages. Our goal is to help you make better decisions about all the software in your supply chain based on trust, context, and quality, in addition to known vulnerabilities.

 New feeds (OSV, GitHub advisories, OpenSSF Scorecards) deepen our vulnerability data and unlock additional package formats.

 Build policies based on how well-maintained a package is, whether it has good documentation, how widely it’s been adopted, and other indicators of package health

 SBOM generation for additional formats, so you can build custom policies from your SBOM metadata.

Trivy kickstarted it. Cloudsmith takes it further.

Push an artifact. Let Cloudsmith scan it, sign it, apply policies, and let you know when new threats emerge. Security shouldn’t slow you down. With Cloudsmith, it doesn’t.

 Push an image or package and watch your policies kick in, so you can sleep easier tomorrow when the next CVE lands.

Ciara Carey

Solutions Engineer

Using Trivy Inside Cloudsmith

Yet another supply chain attack has surfaced, this time using the xrpl library to sneak through malicious packages. 

 is recognised as the recommended npm library for integrating the 

 with JavaScript/TypeScript applications, and has over 140k downloads a week.

Our security team quickly responded to this threat and found that no Cloudsmith customers are currently using any of the affected versions.

The attack strategy was to introduce five suspect versions of the library, masquerading as genuine releases. They inserted a crypto-stealing backdoor by adding malicious code that could leak private keys and silently sign fraudulent transactions.

npmjs have recently released version 4.2.5, which overrides the compromised versions.

 can get a full and detailed description of the attack from Charlie Eriksen at 

XRP supply chain attack: Official NPM package infected with crypto stealing backdoor.

The vulnerability is logged with the CVE Dictionary Entry of 

XRPL Dependencies - A Critical Security Risk

The XRPL is a Layer 1 blockchain built for payments and asset transfers. Layer 1 blockchain is the foundational infrastructure of a blockchain. This is where core functions are handled, such as validating transactions, securing the network, and ensuring consensus around transactions and ownership.

The XRPL is used by financial institutions, fintech companies, developers, and startups, mostly for payments, asset tokenization, and building lightweight financial applications.

A supply chain attack on a package integrating with the XRPL can have serious implications. It could expose private keys, hijack transactions, or leak sensitive data, without compromising the ledger itself. If xrpl.js is compromised, any apps using it could unknowingly sign malicious transactions or leak user information, which could result in stolen funds. XRPL dependencies are critical to security.

Any security features can and should be tested against real-world threats. Cloudsmith’s Enterprise Policy Management (EPM) includes policy-as-code, meaning custom policies can be written against precise requirements to block known exploits.

For the xrpl.js attack, we know the bogus versions, so it’s easy to write Rego code that checks your repository against the known versions. Cloudsmith can then quarantine the packages if there’s a match against npm packages named xrpl:

 information on setting up and configuring policy code, see 

Enterprise Policy Management Example: Quarantine Packages Using Policy as Code

smith and see how it can stop supply chain attacks.

Ian Taylor

Tech Content Director

XRPL Supply Chain Attack and How to Block it Using Cloudsmith’s Enterprise Policy Management

Policy management is a programmable, policy-as-code layer that controls the security, compliance, and flow of artifacts across the software supply chain. Teams can codify rules once and apply them continuously across repositories. With Cloudsmith’s platform, organizations extend policy enforcement across teams, environments, and geographies without introducing friction, including the open source packages that the chain depends on.

Our policy management is powered by data at every stage. It has access to all available package metadata to inform decisions. Every policy action is recorded with full context, providing detailed logs for customers to support audits and investigations. Policy management includes compliance dashboards that surface insights in security, compliance, and policy activity. This gives you continuous oversight and helps you refine your approach.

This article provides an overview of policy management and how it strengthens the software supply chain. For a worked example using policy as code, see 

Policy Management Example: Quarantine Packages Using Policy as Code

We built policy management because governance should not slow you down; it should accelerate trust. Threats to your software supply chain are evolving faster than human oversight can track, and automation is the only viable path to resilience. Policy management puts policy enforcement early in the development process. It makes decisions transparent and turns your security and compliance posture into something repeatable, testable, and version-controlled, like the rest of your codebase. Developers get immediate insight to help select packages. They know which meet policy standards for security, licensing, and quality.

Policies are codified rules that automate decisions and enforce rules on which packages are allowed in your software supply chain. They provide guardrails that ensure security, compliance, and operational consistency. Policies can block vulnerable packages, restrict problematic licenses, and control access.

For example, an enterprise may add a policy that stops packages with high-risk vulnerabilities from reaching production environments. The policy would be prescribed by logic as follows:

Define logic that evaluates vulnerability criteria and applies a quarantine action to affected packages.

The criteria specifies that the vulnerability must be listed in the Common Vulnerabilities and Exposures (CVE) database.

The policy then checks if the vulnerability exceeds a defined 

If conditions are met, the package can either be quarantined and blocked from promotion to production or tagged with additional context for further forensics.

This previous example is a vulnerability policy and is one of the types Cloudsmith’s policy management supports:

 prevent non-compliant code from being used.

 automate tagging, quarantining, or deleting based on metadata.

Without strong policy management, teams face increased risk and unnecessary effort:

- Missing automation allows known CVEs or malicious packages to reach production.

 - Teams must scramble for audits instead of demonstrating continuous compliance.

- Engineers spend hours reviewing dependencies or waiting for late-stage approvals.

Without shared policies, standards vary across teams and environments.

Without codified policies, organizations cannot fully benefit from the scale and speed of the cloud.

Catching vulnerabilities early in the software delivery lifecycle reduces both the financial cost of remediation and the risk of reputational damage.

Policy management was built to avoid these issues in response to real-world supply chain threats and close collaboration with our customers. Codification and automation provide a unified approach for teams to enforce decisions that were previously enforced manually and inconsistently, proving less robust or scalable.

Policy Management’s Impact on Key Enterprise Roles

In an automated delivery environment, policies are essential for reducing manual overhead, preventing costly mistakes, and proving compliance, and have particular relevance within the organization:

-For CISOs, policies are the cornerstone of a secure software supply chain. They enable proactive threat mitigation, enforce compliance with frameworks like SLSA and SC2CF, and provide the audit trails required for regulatory confidence. Cloudsmith’s policy management lets CISOs shift from just enforcing checklists to actively collaborating with engineering teams by using the same tools. Implementing automated policies makes it easier for the engineering team to build securely.

- CTOs are focused on enabling product velocity without compromising architectural integrity. Effective policy management acts as a safeguard for CTOs, giving them confidence to move fast with greater safety, supporting both innovation and security goals. With policy management, they can align engineering output with business goals, ensure consistent implementation of best practices, and reduce the operational burden of manual reviews.

Teams immediately benefit by switching from public repositories to Cloudsmith as a curated repository for their developers. Policies then provide clarity, speed, and safety for engineering teams. Instead of guessing what is allowed, developers get immediate feedback when a package or dependency violates a rule. Our policy management integrates policy checks directly into the artifact pipeline, shifting decision-making left and reducing the noise and frustration caused by late-stage security reviews. 

Cloudsmith’s Approach to Policy Management

Maximum Flexibility: Policy-As-Code, Open Policy Agent, and Rego

Cloudsmith builds for developers, and policy management continues that focus by applying code's flexibility and automation to policy enforcement. Policy management takes a policy-as-code approach, using codification to make policies flexible, versioned, testable, and part of the everyday development workflow. It uses repeatable logic and brings security and compliance into the same toolchain engineers already use.

 - Teams write policies in Rego to define clear, actionable rules that operate on artifact metadata, repository structure, and scan data. We chose 

 because it is an established, open-source policy language widely used in infrastructure and platform security. Rego allows teams to write expressive, testable rules and reason over structured data, which aligns with how Cloudsmith models package metadata and security inputs.

 OPA is a general-purpose tool for evaluating rules written in Rego. Cloudsmith integrates OPA into its policy management to provide a programmable, scalable way to enforce policy across artifacts. Because OPA is already well established in platform tooling like Kubernetes and Terraform, teams can manage policies in a format they know and trust, without switching tools or inventing new processes.

- Policy management also offers key features through the Cloudsmith UI, supporting essential controls that let users manage policies without needing to dive into policy as code.

You can see an example of the Rego code used to implement the policy given in Vulnerability Policy Example above.

Cloudsmith’s policy management lets you create and automate vulnerability policies to an exact specification. Policies evaluate packages as they arrive and apply structured logic to make decisions based on severity, exploitability, and metadata. We made package data available so you have the information to tailor and align your policies to the datasets that matter most.

The following capabilities form the foundation of Cloudsmith’s approach to automated vulnerability policies:

Vulnerability Management & Dependency Awareness

 - Policy management scans artifacts continuously and examines both the dependencies developers choose directly and the ones that come bundled with them. This helps teams understand the full scope of their exposure, especially when vulnerabilities are introduced through nested packages or upstream registries.

 - CVSS scores represent how severe a vulnerability is, while EPSS scores estimate how likely it is to be exploited in the real world. Cloudsmith supports both scoring systems to help teams write policies that prioritize the vulnerabilities that pose the highest risk.
See 

Cloudsmith Introduces EPSS Scoring in Policy Management

 - Teams can preview how a policy will behave before activating it. This reduces the risk of unintended disruption and helps refine logic before activation. Once a policy is active, policy management logs each decision, making actions traceable and audit-ready.

Policy management continues to evolve, and we’re expanding the scope of what policies can evaluate. This includes extending scanning to third-party sources like OpenSSF Scorecards. We’re enriching package metadata with contextual signals, giving policies a broader view to make more accurate decisions.

Legal teams and engineering organizations need to manage license risk at scale. Cloudsmith’s policy management allows teams to define precise rules about which licenses are permitted, restricted, or prohibited across repositories and environments. Policies can block packages with unknown, copyleft, or non-compliant licenses before they are introduced into critical environments. These rules operate on package metadata and are enforced automatically at sync, ensuring consistent application across teams and projects.

Policy management’s license capabilities include the following:

 - Packages with prohibited licenses are blocked by codifying license rules into policy logic. These policies evaluate license metadata before packages reach environments where risk cannot be tolerated, such as production environments or regulated systems.

 -Policies can reflect both internal legal requirements and external compliance frameworks. Teams can author policies that support organization-specific license strategies while aligning with broader standards such as SPDX or OpenChain.

Manage Internal Remediation SLAs with Time-Based Policies

Time-based policies help teams manage the lifecycle of packages based on changing risk, review cycles, or policy timing. These policies allow organizations to enforce rules that adapt over time, such as delaying access to a package until it has passed a minimum review period or increasing enforcement if a vulnerability remains unaddressed beyond a defined threshold.

Our time-based policy management includes CVE lifecycle enforcement. A policy can allow packages with a known high severity CVE to remain in a non-production repository for a defined period. If no fix is applied during that window, the policy escalates enforcement by blocking promotion, triggering quarantine, or flagging the package for remediation. This gives teams time to assess and respond while maintaining clear accountability and control.

We’re extending policy capabilities to increase support for time-based controls. This includes defining policies that delay promotion, trigger re-evaluation, or expire package access after a specific time window. This will support workflows like phased rollouts, cooling-off periods, or automatic clean-up of outdated packages.

Cloudsmith’s policy management allows teams to define precise policies in line with their organization’s compliance requirements. These examples reflect common use cases in vulnerability management, license enforcement, and exploitability scoring.

Time and Score Balanced CVE Remediation Policies

Customers can use policy management to build policies that align with their organisation’s internal CVE remediation timelines or industry best practices. Policies could escalate enforcement based on how long a CVE has gone unpatched.

For example, quarantine any package that has a:

CVE with a CVSS score of 9 or more that was reported 7 or more days ago.

CVE with a CVSS score of more than 7 that was reported 30 or more days ago.

CVE with a CVSS score of more than 4 that was reported 60 or more days ago.

Customers can use policy management to control which software licenses are permitted in their environments. Many organizations prevent the use of copyleft licenses because these licenses can require proprietary source code to be made public. Copyleft licenses, such as the GNU General Public License (GPL), impose obligations that conflict with closed development. Teams often prefer permissive licenses such as MIT, Apache, or BSD to minimize legal risk.

Quarantine any package that carries a GNU General Public License (GPL).

Quarantine any GPL-licensed package found in production repositories, with the highest legal exposure.

Customers can strengthen their vulnerability management by using the 

Exploit Prediction Scoring System (EPSS) 

as an additional prioritization tool. EPSS provides a daily probability estimate for the likelihood of a CVE being exploited in the wild. This helps teams move beyond severity alone and focus remediation efforts on the vulnerabilities most likely to be targeted.

Quarantine any package containing a CVE with an EPSS score of 0.2 or more.

Policy Management for the Vigilant Enterprise

Software governance is an operational necessity. Cloudsmith’s policy management provides a programmable layer that helps teams codify their organization's vision for secure and compliant software and then enforces those standards automatically.

By aligning security, legal, and engineering teams around shared, automated rules, policy management removes friction and gives control, making governance part of the pipeline.

To discover how Cloudsmith’s policy management can solve your needs, 

Cloudsmith Blog

Using Trivy Inside Cloudsmith

XRPL Supply Chain Attack and How to Block it Using Cloudsmith’s Enterprise Policy Management

Policy Management with Cloudsmith