Cloudsmith x Travelport
Who checks the packages your AI tools install?
Travelport now builds Trip Services with Claude. More of the open source in your builds is chosen by AI, and they're deployed more quickly than any human review chain can handle.
Your developers keep working the way they do now
Cloudsmith sits between your builds and public registries like npm, PyPI and Maven Central. Developers, CI pipelines and AI agents point at Cloudsmith once, then install packages as they always have. Your policies run on every request automatically, so nobody waits for a ticket or a review.
Same commands
npm, pip, Maven and Docker work as before. Only the registry URL changes.
Approved packages arrive straight away
Anything that already passes your policies is served from cache across 600+ edge locations.
Blocks happen at install, not after merge
A risky package is stopped when it's requested, and the decision is logged. Developers find out in seconds rather than from a scan days later.
AI agents follow the same rules
An agent can install what passes your policies and can't install what doesn't.
Three supply chain attacks from the last eight months
Each one reached developer machines and CI through an ordinary install command. Two went after AI tooling directly.
LiteLLM 1.107.0
PyPI and Docker Hub · October 21, 2026
A widely used AI gateway library shipped a credential stealer aimed at cloud credentials and AI provider API keys. PyPI removed it about 100 minutes after it was published.
- What stops it: A cooldown policy. The malicious version is never installable during the window when it’s live.
Tensorlake SDK 0.5.144
npm · October 8, 2026
A preinstall script launched a worm that stole npm, GitHub and cloud credentials along with AI coding tool configs, and kept access after the package was removed.
- What stops it: A cooldown policy, then a malicious package policy once the version is flagged.
axios
npm · March 31, 2026
An attacker used a stolen maintainer token to publish versions of one of JavaScript’s most-used HTTP clients that installed a remote access trojan. The versions were pulled within hours.
- What stops it: A cooldown policy, then a malicious package policy once the version is flagged.
Where this is heading
We’ve tracked the Shai-Hulud worm family since it first appeared in September 2025. Recent variants publish packages with valid SLSA provenance signatures, hide their payloads in native build files and compiled binaries, and plant settings files that turn AI coding assistants such as Claude Code into the trigger. The worm’s code is now public, so more groups are running their own versions.
In all three cases, a cooldown policy would have kept the malicious release out of builds, and a malicious package policy blocks it for good once it’s flagged.
What Cloudsmith does
Policy at the first pull
Malicious package and cooldown policies stop flagged or brand-new upstream versions before they reach a developer, an agent or CI.
Continuous re-checks
Packages already in your repositories are re-evaluated as new threat intelligence arrives.
No registry to run
Fully managed and served from 600+ edge locations. Configure it with Terraform and authenticate from GitHub Actions with OIDC.
Package policy belongs at the registry.
Recommended read: AI is breaking your artifact governance.
Aer Lingus and other airlines use Cloudsmith
One large airline moved off on-prem JFrog Artifactory in four months and now runs a fully managed service.
Security company
Moved to one gateway with malware blocking, quarantine and a cooldown policy.