Cloudsmith’s npm client support now serves npm's attestations and signing keys APIs, so provenance verification works through Cloudsmith just as it does when connecting directly to the upstream registry.
npm packages can be published with signed provenance: a verifiable statement that a specific tarball was built from a specific source repository using a specific workflow. Clients verify this with npm audit signatures, and pnpm 11 and later request them during dependency resolution.
While indexing an npm upstream, Cloudsmith stores the provenance attestations published alongside each package and serves them from the same endpoints npm clients already expect (/-/npm/v1/attestations/ and /-/npm/v1/keys). No client or .npmrc changes are needed:
npm audit signaturesVerification remains client-side: your client checks provenance against Sigstore’s public trust root, and registry signatures against the signing keys Cloudsmith serves. Re-serving this data through Cloudsmith doesn’t change the trust model.
Note:
Attestations exist only for packages where the publisher generated provenance when publishing upstream. Cloudsmith serves the attestations published by the upstream registry and doesn’t generate them itself.
Two changes reduce the work involved in resolving npm packages: pnpm clients make fewer requests to Cloudsmith, and every npm repository makes fewer lookups to upstreams. No configuration changes are needed…
The Cloudsmith CLI now sends anonymous reports of unexpected errors to Cloudsmith by default, so we can find and fix crashes without waiting for a support ticket. It also connects through Transport Layer Security (TLS) intercepting proxies without turning off certificate verification, and installs credential helpers where package-manager upgrades can't remove them. Username and password login with 'cloudsmith' login and 'cloudsmith token' is deprecated and stops working on November 20, 2026…
Username and password login with cloudsmith login and cloudsmith token is deprecated and stops working on November 20, 2026. If you authenticate the CLI by running cloudsmith login or cloudsmith token with a username and password — including from scripts and CI jobs — you need to switch to an API key before that date…
Store artifacts closer to your users and CI/CD pipelines in India, so downloads are faster…
Usage limits used to be set with sliders, which were imprecise and cumbersome. Based on customer feedback, you can now type an exact value instead. Workspace owners and managers can set them on the workspace Settings tab, under Usage limits…
Cloudsmith now supports ActiveState Curated Catalog upstreams, with configuration built into the Libraries tab…