Lessons from the axios npm attack

 named me publicly as their new CEO. I’m joining 

, the co-founders of Cloudsmith, in building the world’s most powerful software supply chain platform.

The transition has actually been underway since I came to Cloudsmith’s HQ here in Belfast, Northern Ireland, on August 21. I’ve spent the past month meeting Cloudsmithers, our customers, and our investors. I’ve also 

, why he and Lee created the company, and what problems we’re solving for customers.

I’ve just spent the last four years as Chief Customer Officer at 

, where we served a network of millions of software developers with a broad set of communications APIs. Cloudsmith is also “by developers, for developers.” I first learned about version control systems and makefiles in the late 1990’s, but building and deploying software has become incredibly complex over the past few decades. Developers now need to master a deep stack of dependencies, and most of the bits we actually deploy are sourced from third-party libraries and other external artifacts.

Building and distributing software artifacts is core to the task of building software, and it warrants its own management control layer. Software organizations need a central approach for sourcing packages and containers from the likes of npm (JavaScript), pypi (Python), Maven Central (Java), and DockerHub (Docker), combining them with homegrown code, and distributing the resulting artifacts - which may themselves be packages or containers - to internal or external customers.

Using Cloudsmith as your software supply chain platform - controlling what comes in, and what goes out - gives you a place to plug in observability, security scanning, license checking, performance monitoring, and other value-added services to your CI/CD pipelines. And it allows you to distribute your software artifacts in a way that’s native to the developers that are consuming them - in their own CI/CD pipelines - and it lets you track and control that distribution.

This is actually not a new market. Competitors like JFrog’s Artifactory and Sonatype’s Nexus have provided artifact management for over a decade. But these legacy tools, which started out as on-premise and still today have a one-instance-per-customer model, were built for the pre-cloud generation. , Cloudsmith is the only player in the space that’s built from the ground up as a massive scale, multi-tenant Software as a Service (SaaS). This is a big reason I’ve chosen to join Cloudsmith. At 

, a startup I co-founded in 2006, we made a series of three bets that paid off in helping us build a great company - that Salesforce would displace Siebel in CRM, that Gmail would displace Exchange in corporate email, and that Workday would displace Peoplesoft in HRMS. In each case, despite serving customers increasingly poorly, the entrenched incumbent was the safe, de facto choice for most companies. But in each case, a new company built on the SaaS business model became the new standard - first slowly, then all at once, within a few years.

Cloudsmith is the next great SaaS platform that will displace seemingly comfortable incumbents that are built on yesterday’s outdated business model. We’re delivering global scale to our customers, and we’re innovating faster.

, along with a set of strong company values. I love that we are born and bred as a Northern Ireland company. I love that we are already serving an amazing set of software organizations like those at Shopify, VMware, StackOverflow, EnterpriseDB, Carta, and hundreds of others. I love that we are making the lives of software developers easier. I feel at home at Cloudsmith.

If your software organization is still running an on-premise (or “hosted”) legacy artifact management platform, or if you’re deploying production software that’s built by pulling directly from public software package indexes, or if you’re distributing your software in the form of packages to your customers’ software orgs, then 

. You’ll get a fully-featured trial edition to play with. If you REALLY want to talk to a salesperson, we have those too :) Or just contact me directly - I’d love to hear how it’s going.

A special thank you to two inspirational CEOs, 

 at Tercera, for showing me how to do the job right. I hope I can live up to their standards! And thank you to Alan, Lee, and all the Cloudsmithers for the warm welcome and the awesome onboarding thus far!

Cloudsmith Blog

Hi. I'm the new CEO :)