Download package vulnerability findings from the Cloudsmith web app
Vulnerability and malicious package findings can now be exported as a JSON file directly from the web app…
Client logs in the Cloudsmith web app now capture format-specific metadata across every package format Cloudsmith supports. This gives you complete visibility into the traffic being served across your workspace, including package metadata fetches across your toolchain, not just direct package downloads.
Format-specific metadata is currently available in client logs in the web app. Log exports will include this data from November 2026.
You can now see the full chain that led to a package download, including exactly which version a build pulled. For example, for the following npm install, the initial request results in two additional hops, all recorded and available in client logs:
15:35:31: npm requests metadata for the @csm/e2e2-push-cli package from the native domain (npm.cloudsmith.io):
15:35:31: Cloudsmith resolves the request to version 1.0.0-e69fae5b and returns a 307 redirect response to the download domain (dl.cloudsmith.io):
15:35:32: Cloudsmith serves the 1.6KiB file from dl.cloudsmith.io with a 200 response:
For more information about using client logs, see the Cloudsmith documentation.
Vulnerability and malicious package findings can now be exported as a JSON file directly from the web app…
Package logs are now available in the Cloudsmith web app, giving you a per-package audit trail: what changed, who changed it, and when…
Workspace owners can grant each privilege separately, without giving members the Manager or Owner role…
When an exposed Cloudsmith API key is detected in a GitHub repository, the email notification sent to the affected Cloudsmith user and workspace owners now lists every location the key was found in GitHub, with a direct link to each detection…
You can now apply cooldown policies to Cargo packages, protecting your supply chain from newly published versions that may carry malware or have not yet undergone sufficient community scrutiny…
You can now apply cooldown policies to Conda and Docker packages, protecting your supply chain from newly published versions that may carry malware or have not yet undergone sufficient community scrutiny…