Continuous risk detection

Know the moment a package in your repository becomes a risk.

Continuously monitor your open source packages against the latest vulnerability and malicious package intelligence. When new threats are published, we check for matches so your view stays current.

One place to see risk.

Every package in your registry is checked against live threat intelligence, not just the ones passing through a pipeline right now. New CVEs and malicious packages are matched the moment they publish, and that view is shared by every pipeline and developer pulling from the repository.
Outcomes

Continuous risk detection with Cloudsmith

    Draw from the open-source community's own threat intelligence
    Community-vetted feeds - Ingest and normalize vulnerability and malicious-package intelligence from OSV.dev, the open-source ecosystem's own intelligence feed.

    Continuous updates - Poll for new advisories on an ongoing basis, so newly published intelligence reaches your repository without waiting for the next scan cycle.

    Complements your SCA stack - Sits alongside your existing scanning and SCA tools, checking every package at ingestion and continuously afterward.
    Identify risk continuously
    Risk identification - Identify risk the moment intelligence updates, advisory data stays continuously refreshed and checked against your registry.

    Automatic policy actions Ship with confidence as matches feed straight into policy, so risk gets acted on automatically.

    Prioritize what matters
    EPSS-driven prioritization - Prioritize what matters most with EPSS scores that surface exploitability probability alongside severity.

    Malicious packages identification - See malicious packages flagged distinctly in the UI and API, not folded into a generic vulnerability list.

    Pinpoint risk inside your containers
    Container component mapping - Map components of container images to known risk.

    Precise vulnerability location - Pinpoint which component carries a vulnerability for patching.

See continuous risk detection in action.
Speak to a Cloudsmith expert about protecting your organization from supply chain threats.

Frequently Asked Questions

  1. It means your open-source packages get checked against vulnerability and malicious package intelligence as new threats come in, not just at scan time. So if a CVE drops on a Tuesday afternoon, you find out that day because it is surfaced in our webapp, via API, and policies are automatically applied, not whenever your next scheduled scan happens to run.

  2. A scheduled scan only tells you what's true at that moment. The problem is everything that happens after, new CVEs and malicious packages get published constantly, and a package that looked fine yesterday can be flagged today. Continuous detection closes that gap by checking against fresh advisory data as it updates.

  3. Because that's usually where the blind spot is. Teams tend to scan packages going into a build, but the ones that already made it through don't get rechecked unless something is actively watching for new intelligence. Those are the ones most likely to have risk that isn’t managed because they aren’t being actively checked.

  4. PURL stands for Package URL, it's a standard format for identifying a package (think ecosystem, name, and version, all in one string). Matching against PURLs is fast and lightweight compared to heavier scanning methods, which is why it's used here to keep pipeline impact minimal.

  5. CVSS tells you how bad a vulnerability could theoretically be. EPSS tells you how likely it is to actually get exploited in the wild in the next 30 days. Used together, they help you tell the difference between "technically severe but unlikely to be targeted" and "moderately severe but actively being exploited" which matters a lot when you're deciding what to fix first.

  6. Yes, rather than flagging the whole image, component mapping identifies exactly which piece inside it (a specific library or dependency) is tied to the vulnerability. That's what makes it possible to patch the actual problem instead of guessing.