The attack on SolarWinds in December 2020 was a watershed moment: it provided a stark demonstration of how much damage a compromised software supply chain could cause, and a wake-up call for how much trust organizations place in the integrity of the software they depend on. Overnight, everyone learned what a software supply chain was.
Developers spent weeks mitigating the risk. Six years later, attackers are now supercharged by agentic AI’s capabilities, and increasingly going after open source packages. The very dependencies that make modern software possible are also putting it at risk. The scale and magnitude of today’s onslaught, with multiple attacks a day, would have been unimaginable in 2020.
At the same time AI enables attackers to target any company through the software that runs their business, companies are also building more software than ever. The pace of software development has outstripped what any manual review processes could keep up with. Dependency decisions were traditionally made by a human developer, but now those decisions are increasingly made by AI, either by a citizen developer who is vibe coding or by an AI agent whose mission doesn't include keeping your supply chain free of malicious packages and actors.
The usual security model teams have relied on - periodic scanning, resolving issues immediately where possible, backlogging lower-priority issues - can’t keep up with the pace or the style of the attacks we face today. In March 2026, a maintainer account for the popular npm package axios (100M+ weekly downloads) was compromised, allowing attackers to slip in a malicious dependency carrying a postinstall script that ran the instant npm install was called. A malicious package can compromise a developer's machine or a build pipeline instantly, before the first build. Workflows built to protect production are no longer enough to prevent breaches.
Protecting your entire organization from cyberattacks requires defense in depth. A critical component of keeping software safe is a curated repository. This means a private, controlled repository that manages software artifacts from the point of ingestion, all the way to production.
When every pull, every build, and every package request flows through a centralized repository like Cloudsmith, you get one place to control what software enters your supply chain, and how it moves through to production.
The right private, curated repository serves several functions. It:
This kind of curated repository becomes the orchestration layer that builds trust in your software supply chain. The way to get it is to use a universal artifact management platform with risk detection and policy built in.
Cloudsmith's new policy management and continuous risk detection capabilities should be considered table stakes for any organization that wants to control and secure its software supply chain.
Write your own logic in Rego, the open source policy language used in the Open Policy Agent (OPA) framework, tailored to your specific security and compliance requirements.
Policies are evaluated on package ingestion, and re-evaluated in real time automatically as policies or threat intelligence changes
Cooldown policies hold new package versions back from clients for a set window of time, so security researchers have a chance to identify malicious releases.
Cloudsmith-recommended policies already written for you, so you don't need to write Rego from scratch.
A full audit trail of every policy evaluation, viewable in the web app and downloadable via API
Because they’re written as code, Cloudsmith policies are incredibly powerful and flexible. You can make decisions based on key attributes of a package, like license information or package age. Cloudsmith's continuous risk detection systems bring security intelligence into the policy layer, so your policies keep up with the latest threat intelligence.
In the Cloudsmith platform, threat detection runs automatically, for every supported package format in your workspace. Cloudsmith refreshes threat intelligence every five minutes, so if a new or updated record affects packages already in your repositories, they’ll be matched automatically. The days of scheduling periodic rescans are over.
To make sure nothing is missed, packages are matched to public security advisories based on a standard identifier called a package URL (PURL). Cloudsmith supports SemVer and ecosystem-native version ranges when matching advisories to specific versions of packages.
A single publicly identified vulnerability may be reported by multiple sources, resulting in duplicate records from different upstream databases. Cloudsmith automatically detects these duplicates, grouping and surfacing one primary record per vulnerability. This results in cleaner data and more focused reviews.
By default, packages are sorted by severity, highest first: Malware, then Critical, High, Medium, Low, and Unknown.
Over the years, we’ve found that artifact management has historically been the purview of platform engineering teams. These teams traditionally look to centralize critical workflows, to ensure consistent, standard delivery. But we’ve seen a change in the market recently. Security teams are increasingly recognizing that centralizing these workflows enhances security. Cyber security teams can partner with developers by enforcing policies that redirect direct access to public registries to a curated, managed repository that serves as a trusted proxy. Development teams still need to move fast, so enforcement actions that affect a developer's workflow have to be built with the developer experience in mind.
Cloudsmith solves this in a uniquely developer-friendly way. Cloudsmith policies remove bad packages from the index that is presented to package managers. This changes the package version selection process, so that developers get compliant packages the first time, rather than an error message and a broken build. If a specific pinned package version is requested, but that version has been quarantined for security reasons, clear messaging and integrated workflows tell developers why their build failed, and what they can do about it.
We’ve all come a long way since the SolarWinds attack in 2020. We’ve learned how to secure the software supply chain, without slowing down developers. Every package your team requests should pass through curated repositories, where policies tailored to your security and compliance requirements can protect your builds, backed by realtime, always-updated threat intelligence. The artifact management platform serves as the orchestration layer, across every team, pipeline, and AI agent, enforced at the source, automatically.
See how continuous risk detection and policy management work or contact us for a demo to see how we can solve your needs.
