Vulnerability and malicious package findings can now be exported as a JSON file directly from the web app. 

 tab to export a JSON file containing every vulnerability and malicious package record currently matched to that package.

Package vulnerability data is also available from the 

 API endpoint.

Vulnerability and malicious package detection is available on Ultra and Enterprise plans.

Package logs are now available in the Cloudsmith web app, giving you a per-package audit trail: what changed, who changed it, and when.

Package logs sit alongside client and audit logs under 

Each entry records a timestamp, an action, the actor who performed it, and the affected package and version, plus detailed metadata such as package size and actor IP address. 

You can filter the logs by action, target, and actor to isolate a single event or narrow an investigation.

Cloudsmith creates package logs for the following actions:

Package downloads are recorded in client logs.

Track every change to your packages with package logs

Workspace owners can grant each of the following privileges separately, without giving members the Manager or Owner role:

View workspace usage data, including artifact data and package delivery quotas

View workspace OpenID Connect (OIDC) settings

Only workspace managers and owners could previously view this data. Each privilege applies to all members of the workspace.

You can configure these in your workspace settings under 

Give members read-only access to billing, usage, and OIDC data

When an exposed Cloudsmith API key is detected in a GitHub repository, the email notification sent to the affected Cloudsmith user and workspace owners now lists every location the key was found in GitHub, with a direct link to each detection.

Pull request titles, descriptions, comments, and reviews

The Cloudsmith workspace audit log records an 

 event for each detection, with the masked key and detection location.

Exposure detection for Cloudsmith API keys in GitHub runs through the 

GitHub secret scanning notifications now link to each detection location

You can now apply cooldown policies to Cargo packages, protecting your supply chain from newly published versions that may carry malware or have not yet undergone sufficient community scrutiny.

You can create cooldown policies via the Cloudsmith API, Terraform provider, and web app.

This feature is available for Ultra and Enterprise customers using policy management with policy as code.

Cooldown policies are now supported for npm, Python, Go, Maven, NuGet, Conda, Docker, and Cargo. For more information about using cooldown policies, see 

Cooldown policies now support Cargo

You can now apply cooldown policies to Conda and Docker packages, protecting your supply chain from newly published versions that may carry malware or have not yet undergone sufficient community scrutiny.


You can create cooldown policies via the Cloudsmith API, Terraform provider, and web app.

Cooldown policies are now supported for npm, Python, Go, Maven, NuGet, Conda, and Docker. For more information about using cooldown policies, see 

Cooldown policies now support Conda and Docker

See how published packages are being consumed - downloads, entitlement token use, and client logs - without leaving the Broadcasts app.

See how many public, open source, and private packages are currently broadcasting and how many entitlement tokens (authentication tokens used to track and control package downloads, often issued per customer) have been active this billing cycle, alongside usage by repository and your most-downloaded packages.

An interactive world map shows download distribution, with a sortable table of usage and request counts by country. Filter by usage period, date range, country, and broadcast.

View a timestamped event stream of package requests, which you can filter by status code, package format, IP address, country, and more.

Download package vulnerability findings from the Cloudsmith web app

Other logs

Track every change to your packages with package logs

Give members read-only access to billing, usage, and OIDC data

GitHub secret scanning notifications now link to each detection location

Cooldown policies now support Cargo

Cooldown policies now support Conda and Docker

Track downloads, token use, and client logs in the Broadcasts app