software supply chain security - Cloudsmith

software supply chain security

A collection of 6 posts

Secure Docker Image Pulls from Cloudsmith to Kubernetes using OIDC

Secure Docker Image Pulls from Cloudsmith to Kubernetes using OIDC

Pulling Docker images from private registries for containerised applications presents a security challenge. It requires authentication management, network access, and trust across distributed systems. Credentials must be securely handled and rotated, and image pulls can break due to network restrictions or expired tokens. All of this makes deployment and security

Multiple Malicious Packages Discovered on PyPI, npm, and RubyGems

software supply chain security

Multiple Malicious Packages Discovered on PyPI, npm, and RubyGems

Evidence of broad and sustained attacks using several npm, Python, and Ruby packages continues to emerge. A series of malicious packages have been added to the npm, PyPI, and RubyGems package repositories. The attacks have been ongoing for some time, with some seeded years ago. Their aims are manifold, including

XRPL Supply Chain Attack and How to Block it Using Cloudsmith’s Enterprise Policy Management

XRPL Supply Chain Attack and How to Block it Using Cloudsmith’s Enterprise Policy Management

Yet another supply chain attack has surfaced, this time using the xrpl library to sneak through malicious packages. xrpl.js is recognised as the recommended npm library for integrating the XRP Ledger (XRPL) with JavaScript/TypeScript applications, and has over 140k downloads a week. No Cloudsmith Customers Affected Our security

Enterprise Policy Management with Cloudsmith

Enterprise Policy Management with Cloudsmith

Enterprise Policy Management (EPM) is a programmable policy-as-code layer that controls the security, compliance, and flow of artifacts across the software supply chain. Teams can codify rules once and apply them continuously across repositories. With Cloudsmith’s platform, organizations extend policy enforcement across teams, environments, and geographies without introducing friction,

Cloudsmith Achieves ISO 27001:2013 Recertification

software supply chain security

Cloudsmith Achieves ISO 27001:2013 Recertification

Learn about Cloudsmith's recent ISO 27001:2013 recertification, highlighting the team's unwavering commitment to security excellence and customer trust.

World's First Private Hex Repository with Cloudsmith

World's First Private Hex Repository with Cloudsmith

Level up supply chain security and package management for your organizations Erlang and Elixir teams with Cloudsmith's Private Hex Repositories.