We've significantly enhanced the Cloudsmith Terraform Provider with new 

New data sources have been added to allow customers to retrieve information about their organization's configuration (like a 

 request), enabling the creation of more complex Terraform code based on specific outputs:

 resource now supports several new upstream formats:

For more information, including examples and documentation on all resources, please visit:

https://registry.terraform.io/providers/cloudsmith-io/cloudsmith/latest/docs

Cloudsmith now provides official upstream proxying and caching support for 

 in your npm repositories. This integration enables customers to use Cloudsmith as the primary, secure distribution platform for Chainguard’s malware-resistant, built-from-source JavaScript dependencies.

 Use Cloudsmith as the single source of truth for all npm dependencies, including Chainguard Libraries, ensuring reliability and high availability.

 Gain detailed information and consumption metrics on all package requests and versions in use (including from Chainguard Libraries) through Cloudsmith.

 Leverage Cloudsmith policies to govern what packages flow to users/pipelines, and utilize Cloudsmith’s built-in 

 Chainguard's dependencies are built using their hardened 

, providing verifiable software provenance.

The Chainguard Libraries for Javascript repository only includes libraries built by Chainguard from source. For full coverage, we recommend a dual-upstream configuration to allow for a fallback to the public registry.

Chainguard Libraries for Javascript Upstream (Priority 1)

 Add the Username and Password value from your Chainguard Libraries access settings.

Public npm Registry Upstream (Priority 2 - Fallback)

 for packages not available in Chainguard, ensuring the most secure and reliable consumption workflow possible.

Upstream Support for Chainguard Libraries for Javascript (npm)

 flag to the Cloudsmith CLI, which simplifies your automation scripts by eliminating the need for pagination logic. Previously, fetching large datasets required looping to iterate through 

. Now, the CLI automatically handles the underlying pagination, fetching every requested item and returning the full list instantly. This lets you simplify your scripts and maintain less code.

 flag to the following commands that support pagination:

Simplify your automations with the new show all flag

We've improved how package statuses are displayed and managed across the Cloudsmith web app to help you 

quickly understand if a package or container is available, safe, and compliant.

We have removed the status flag that indicated a package matched a policy, as this information describes an automation outcome and not a fixed status.

We have consolidated all initial processing and scanning statuses that occur before package availability under a single 

Vulnerability and quarantine statuses have been removed from the Tags column; this information is now communicated directly through the main package status indicator.

We’ve added additional status details in the tooltip when a package has an error or is quarantined.

We've updated the color scheme and icons for consistency and clarity:

: Indicates the package is available but there are 

 and is unavailable. (Red will also be used to indicate malware in future updates.)

These updates apply uniformly across the platform, including package lists in workspaces and repositories, compliance pages, and individual package detail pages.

Improvements to package status indicator in the web app

 field to packages in Cloudsmith, extending 

This feature allows you to create retention rules that automatically clean up packages in your repository based on usage, rather than just age or count, ensuring you retain only actively used packages.

 field is available for use in package queries when setting up or modifying retention rules via the Cloudsmith UI, API and Terraform provider. This field is also exposed in the API and UI, and can be used for general package search filtering.

If you want to set up a retention rule that automatically deletes packages older than a year, you can include the following package filter in your retention rule:

Automate repository cleanup based on last download date

. This enables you to define policies that automatically quarantine new packages for a specific time period (e.g., two weeks) after release.

Implementing policies that delay package use is an effective safeguard to protect against zero-day attacks. Enforcing a time lag before consuming a new package or package version gives the community time to find and flag any problems and for intelligence feeds to get updated.

A policy that quarantined npm packages published in the past two weeks 

would have protected organizations during the September 8, 2025 npm attack

 which compromised widely used packages like 

Within two hours, the community had flagged the problem, but automated CI/CD pipelines had already downloaded the latest versions, the ones containing the malicious code.

When used alongside an EPM policy in Cloudsmith to block or quarantine all known malicious packages, you’ll have protection against zero-day attacks and known malicious packages, ensuring these packages never make it into your software supply chain. For more security rules, check out our 

The following Rego code defines a policy that matches and quarantines npm packages whose upstream publish date is within the last 

Upstream publish date is available for npm packages

, with additional formats coming soon. Learn more in the Enterprise Policy Manager 

Enforce vetting for npm packages with publish date policies

Cloudsmith’s Enterprise Policy Manager (EPM)

 data to enable powerful, component-level policies for Docker and OCI container images.

This upgrade extends EPM policy enforcement beyond basic package metadata to the internal components of an image, giving you more control over the composition of containers used within your organization.

With SBOM data, you can now apply EPM policies based on:

 Target specific components by name or other attributes.

 Enforce license compliance by applying rules based on the licenses of any component within the container.

Cloudsmith generates CycloneDX SBOMs for every Docker image or container image uploaded to Cloudsmith.

The SBOM data is made available within the EPM schema (input.v0.sbom field) in the native CycloneDX Bill of Materials JSON format.

You can use any of the available fields in the JSON file to create your own policies. In addition to exploring the schema, 

All standard EPM actions (including block, quarantine and tag) are available when creating policies based on SBOM data.

Here is a simple policy to enforce a strict set of allowed licenses:


This capability is in Early Access, available to Ultra and Enterprise customers via Enterprise Policy Manager. Learn more in the Enterprise Policy Manager 

New data sources and expanded upstream support added to the Cloudsmith Terraform Provider

New data sources

Upstream format support

Other logs

Upstream Support for Chainguard Libraries for Javascript (npm)

Simplify your automations with the new show all flag

Improvements to package status indicator in the web app

Automate repository cleanup based on last download date

Enforce vetting for npm packages with publish date policies

Get more control over containers with SBOM-based policies in EPM