---
title: "Upstream Support for Chainguard Libraries for Javascript (npm)"
description: ""
canonical_url: "https://cloudsmith.com/changelog/cloudsmith-support-for-chainguard-libraries-for-javascript-npm"
last_updated: "2025-11-20T20:20:16.911Z"
---
# Upstream Support for Chainguard Libraries for Javascript (npm)

Cloudsmith now provides official upstream proxying and caching support for **Chainguard Libraries for Javascript** in your npm repositories. This integration enables customers to use Cloudsmith as the primary, secure distribution platform for Chainguard’s malware-resistant, built-from-source JavaScript dependencies.

### **Key benefits**

- **Centralized distribution:** Use Cloudsmith as the single source of truth for all npm dependencies, including Chainguard Libraries, ensuring reliability and high availability.
- **End-to-end visibility:** Gain detailed information and consumption metrics on all package requests and versions in use (including from Chainguard Libraries) through Cloudsmith.
- **Advanced security & policy:** Leverage Cloudsmith policies to govern what packages flow to users/pipelines, and utilize Cloudsmith’s built-in **continuous security scanning** for an always-up-to-date risk profile.
- **SLSA provenance:** Chainguard's dependencies are built using their hardened **SLSA Level 2 build infrastructure**, providing verifiable software provenance.

### **Getting started**

The Chainguard Libraries for Javascript repository only includes libraries built by Chainguard from source. For full coverage, we recommend a dual-upstream configuration to allow for a fallback to the public registry.

1. **Chainguard Libraries for Javascript Upstream (Priority 1)**
   - **Priority:** 1 (Highest)
   - **Upstream URL:** https://libraries.cgr.dev/javascript/
   - **Mode:** Cache and Proxy
   - **Authentication:** Add the Username and Password value from your Chainguard Libraries access settings.
2. **Public npm Registry Upstream (Priority 2 - Fallback)**
   - **Priority:** 2 (Lower priority)
   - **Upstream URL:** https://registry.npmjs.org/
   - **Mode:** Cache and Proxy

```json
{
  "_key": "e7b1f6bb5a31",
  "_type": "image",
  "alt": "Upstream proxies configured in priority order for Chainguard Libraries and the main npm public registry ",
  "asset": {
    "_createdAt": "2025-11-20T20:16:26Z",
    "_id": "image-f97025f5d21b0539f5172b184b123f69109a7766-1208x313-png",
    "_rev": "Qlug5XDAo7f2E0spvYOibJ",
    "_type": "sanity.imageAsset",
    "_updatedAt": "2025-11-20T20:16:26Z",
    "assetId": "f97025f5d21b0539f5172b184b123f69109a7766",
    "extension": "png",
    "metadata": {
      "_type": "sanity.imageMetadata",
      "blurHash": "DDSZ2:^iDkxqIn?d--E3%KWF",
      "dimensions": {
        "_type": "sanity.imageDimensions",
        "aspectRatio": 3.8594249201277955,
        "height": 313,
        "width": 1208
      },
      "hasAlpha": true,
      "isOpaque": true,
      "lqip": "data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAABQAAAAFCAYAAABFA8wzAAAACXBIWXMAAAsTAAALEwEAmpwYAAAA8ElEQVR4nEWQOU5EQQwF//0PgcQBSAkRIQGQEBBBMAKh2f/Si9t2d6H+M9IEFdiySs9vCDExh0iSgtdKgxvtxm3b50at8Hs0Ht8Dd08T988TDy8LQ06ZmIRcFLWK14ZXrjTU60pxR2vnMndOwfj8EV6/Mm/fmY+NMOTTmTBO9KQ9ZVFHvWHexRdhMmMswqiZSYXZyrrL5gRxluyM2RizMuS/LcvuwDwvhCSIGua+ymoDb43oyrFE9iVw0sRsQjZDzFBzrDbEjWCFQbY7wv7IsoQ1YT9Yu7x218XRlINEdhI4ayK7rp/EXEjSpZcvJi38A2PahC+ZMdN+AAAAAElFTkSuQmCC",
      "palette": {
        "_type": "sanity.imagePalette",
        "darkMuted": {
          "_type": "sanity.imagePaletteSwatch",
          "background": "#705454",
          "foreground": "#fff",
          "population": 0.01,
          "title": "#fff"
        },
        "darkVibrant": {
          "_type": "sanity.imagePaletteSwatch",
          "background": "#a73c4e",
          "foreground": "#fff",
          "population": 0.21,
          "title": "#fff"
        },
        "dominant": {
          "_type": "sanity.imagePaletteSwatch",
          "background": "#a9c7bf",
          "foreground": "#000",
          "population": 0.94,
          "title": "#fff"
        },
        "lightMuted": {
          "_type": "sanity.imagePaletteSwatch",
          "background": "#a9c7bf",
          "foreground": "#000",
          "population": 0.94,
          "title": "#fff"
        },
        "lightVibrant": {
          "_type": "sanity.imagePaletteSwatch",
          "background": "#fc84a4",
          "foreground": "#000",
          "population": 0.01,
          "title": "#fff"
        },
        "muted": {
          "_type": "sanity.imagePaletteSwatch",
          "background": "#a2545a",
          "foreground": "#fff",
          "population": 0.08,
          "title": "#fff"
        },
        "vibrant": {
          "_type": "sanity.imagePaletteSwatch",
          "background": "#1c68de",
          "foreground": "#fff",
          "population": 0.09,
          "title": "#fff"
        }
      }
    },
    "mimeType": "image/png",
    "originalFilename": "Screenshot 2025-11-20 at 2.16.04 pm.png",
    "path": "images/rafvlnhi/production/f97025f5d21b0539f5172b184b123f69109a7766-1208x313.png",
    "sha1hash": "f97025f5d21b0539f5172b184b123f69109a7766",
    "size": 47904,
    "uploadId": "dT9rBrglp8EGBtg1oo0QK8IMKhqIeMBj",
    "url": "https://cdn.sanity.io/images/rafvlnhi/production/f97025f5d21b0539f5172b184b123f69109a7766-1208x313.png"
  },
  "caption": "Upstream proxies configured in priority order for Chainguard Libraries and the main npm public registry ",
  "link": {
    "_type": "link",
    "href": null,
    "openInNewTab": false
  },
  "markDefs": null
}
```

This setup ensures Cloudsmith can **fall back to the public npm registry** for packages not available in Chainguard, ensuring the most secure and reliable consumption workflow possible.

```json
{
  "_key": "4153efa8149a",
  "_type": "callout",
  "content": [
    {
      "_key": "59e2f68770a2",
      "_type": "block",
      "children": [
        {
          "_key": "031c820b9e05",
          "_type": "span",
          "marks": [],
          "text": "Note: "
        },
        {
          "_key": "acb27905109d",
          "_type": "span",
          "marks": [
            "398b82d71c97"
          ],
          "text": "Chainguard Libraries for Javascript"
        },
        {
          "_key": "2e1389cccb5a",
          "_type": "span",
          "marks": [],
          "text": " is currently in "
        },
        {
          "_key": "ef1db61f7cb5",
          "_type": "span",
          "marks": [
            "strong"
          ],
          "text": "Beta Access"
        },
        {
          "_key": "7a0062259e0c",
          "_type": "span",
          "marks": [],
          "text": "."
        }
      ],
      "markDefs": [
        {
          "_key": "398b82d71c97",
          "_type": "link",
          "href": "https://www.chainguard.dev/libraries",
          "linkType": "href",
          "openInNewTab": true
        }
      ],
      "style": "normal"
    },
    {
      "_key": "d8434b8e19c0",
      "_type": "block",
      "children": [
        {
          "_key": "25af9f4659ad",
          "_type": "span",
          "marks": [],
          "text": "\n"
        }
      ],
      "markDefs": [],
      "style": "normal"
    }
  ],
  "markDefs": null,
  "variant": "info"
}
```