The Cloudsmith CLI has had six releases since our last update here. The headlines: you can now push Nix packages, let Cargo and pnpm authenticate automatically with credential helpers, and manage a repository's GNU Privacy Guard (GPG) key and access privileges without leaving your terminal. Along the way, the CLI got faster to start, kinder to macOS users, and better behaved on machines with no OS keyring.

Push Nix packages and mirror Nix channels

v1.25.0 adds Nix as a first-class format. Push packages with 

, the same way you already do for other formats.

Cargo and pnpm now authenticate automatically

 introduced Docker credential discovery. The list of supported package managers keeps growing: the CLI can now handle authentication for Cargo (v1.26.0) and pnpm (v1.25.0) too.

One install command each, and the tool authenticates to your Cloudsmith registries with your existing CLI credentials. No 

. The Cargo provider only ever answers for Cloudsmith registries, so crates.io and any other provider you use are left untouched. Both helpers support custom domains, dry runs, listing, and uninstalling. For more information, see the 

If your tool of choice has no dedicated helper yet, v1.21.0 added a generic one. 

 resolves a credential through the full chain (API key, 

, system keyring, OpenID Connect (OIDC)) and prints it as a small JSON document any script can consume:

Administer repositories from the terminal

v1.26.0 brings two new command groups for repository administration.

 manages the GPG key your repository signs its package indexes with. View the active key, upload your own, or have Cloudsmith regenerate it. The CLI only ever reads key material from a file, stdin, or a hidden prompt, and a dry-run mode tells you exactly which key you are about to replace before anything happens.

 does the same for explicit repository access. List who can see a repository, grant or revoke access for teams, users and service accounts, or replace the whole privilege set from a JSON file for repeatable, reviewable access control.

Push a Debian source package with just the .dsc

 of a Debian source package and works out the 

All Debian source formats are supported, and explicit flags still win if you want control.

Single sign-on (SSO) tokens on headless and CI machines

SSO and OIDC sessions work in more places:

The standalone binary now bundles encrypted file-based keyring backends (v1.23.0), so a headless Linux container with no OS keyring can still persist tokens.

 (v1.24.0) select and unlock a backend non-interactively, and 

 (v1.25.0) control where the tokens live.

 (v1.24.0) prints the SSO URL instead of launching a browser, for remote shells where that would go nowhere.

macOS keychain prompts stop reappearing after every token refresh

If you use the CLI on macOS with SSO, you have probably seen the "Cloudsmith wants to use your credential information" prompt more times than you would like, and clicking "Always Allow" never seemed to stick. v1.26.0 fixes the root cause: the CLI now updates keychain items in place instead of deleting and recreating them, so your permission grants survive every token refresh. Each profile also keeps its own session now, and a session the server has rejected cleans itself up and asks you to log in again instead of nagging you every half hour.

v1.25.0 and v1.26.0 moved the CLI's heavy dependencies out of the startup path; they now load only when a command needs them. You will notice it most in scripts and CI, where the CLI is often invoked many times in a row.

 (v1.22.0) shows every host Cloudsmith can authenticate for you, including your organization's custom domains.

Exit codes are reliable again everywhere, including 

Security assertion markup language (SAML) authentication handles two-factor authentication more gracefully, directing you from the browser back to the terminal and retrying rejected codes (v1.25.0).

CLI v1.21.0 to v1.26.0: Nix support, Cargo and pnpm credential helpers, and repository administration from your terminal

Client logs in the Cloudsmith web app now capture format-specific metadata across every package format Cloudsmith supports. This gives you complete visibility into the traffic being served across your workspace, including package metadata fetches across your toolchain, not just direct package downloads.

Format-specific metadata is currently available in client logs in the web app. Log exports will include this data from November 2026.

You can now see the full chain that led to a package download, including exactly which version a build pulled. For example, for the following npm install, the initial request results in two additional hops, all recorded and available in client logs:

Cloudsmith resolves the request to version 

 and returns a 307 redirect response to the download domain (

For more information about using client logs, see 

Client logs now show the full request chain behind a package download

Vulnerability and malicious package findings can now be exported as a JSON file directly from the web app. 

 tab to export a JSON file containing every vulnerability and malicious package record currently matched to that package.

Package vulnerability data is also available from the 

 API endpoint.

Vulnerability and malicious package detection is available on Ultra and Enterprise plans.

Download package vulnerability findings from the Cloudsmith web app

Package logs are now available in the Cloudsmith web app, giving you a per-package audit trail: what changed, who changed it, and when.

Package logs sit alongside client and audit logs under 

Each entry records a timestamp, an action, the actor who performed it, and the affected package and version, plus detailed metadata such as package size and actor IP address. 

You can filter the logs by action, target, and actor to isolate a single event or narrow an investigation.

Cloudsmith creates package logs for the following actions:

Package downloads are recorded in client logs.

Track every change to your packages with package logs

Workspace owners can grant each of the following privileges separately, without giving members the Manager or Owner role:

View workspace usage data, including artifact data and package delivery quotas

View workspace OpenID Connect (OIDC) settings

Only workspace managers and owners could previously view this data. Each privilege applies to all members of the workspace.

You can configure these in your workspace settings under 

Give members read-only access to billing, usage, and OIDC data

When an exposed Cloudsmith API key is detected in a GitHub repository, the email notification sent to the affected Cloudsmith user and workspace owners now lists every location the key was found in GitHub, with a direct link to each detection.

Pull request titles, descriptions, comments, and reviews

The Cloudsmith workspace audit log records an 

 event for each detection, with the masked key and detection location.

Exposure detection for Cloudsmith API keys in GitHub runs through the 

GitHub secret scanning notifications now link to each detection location

You can now apply cooldown policies to Cargo packages, protecting your supply chain from newly published versions that may carry malware or have not yet undergone sufficient community scrutiny.

You can create cooldown policies via the Cloudsmith API, Terraform provider, and web app.

This feature is available for Ultra and Enterprise customers using policy management with policy as code.

Cooldown policies are now supported for npm, Python, Go, Maven, NuGet, Conda, Docker, and Cargo. For more information about using cooldown policies, see 

Cooldown policies now support Cargo

You can now apply cooldown policies to Conda and Docker packages, protecting your supply chain from newly published versions that may carry malware or have not yet undergone sufficient community scrutiny.


You can create cooldown policies via the Cloudsmith API, Terraform provider, and web app.

Cooldown policies are now supported for npm, Python, Go, Maven, NuGet, Conda, and Docker. For more information about using cooldown policies, see 

Cooldown policies now support Conda and Docker

See how published packages are being consumed - downloads, entitlement token use, and client logs - without leaving the Broadcasts app.

See how many public, open source, and private packages are currently broadcasting and how many entitlement tokens (authentication tokens used to track and control package downloads, often issued per customer) have been active this billing cycle, alongside usage by repository and your most-downloaded packages.

An interactive world map shows download distribution, with a sortable table of usage and request counts by country. Filter by usage period, date range, country, and broadcast.

View a timestamped event stream of package requests, which you can filter by status code, package format, IP address, country, and more.

Track downloads, token use, and client logs in the Broadcasts app

Library registries provide a vendor-curated feed of open source packages. Packages may be pre-vetted, rebuilt from source, and security scanned by the vendor. For details on which of these features are available for a specific registry, see the latest documentation for the registry vendor.


Currently supported quick configure vendors:

Pick a vendor and library, name the upstream, and add your credentials - Cloudsmith fills in the proxy URL for you.

Other library registries can still be added as upstreams by using manual configuration. To register interest in additional quick configure vendor support, please 

Cloudsmith Changelog