Cloudsmith adds cooldown policies for software supply chain

Cloudsmith has introduced new policy controls for software supply chain governance in its artifact repositories. The update adds cooldown policies, policy templates, and expanded evaluation triggers.

The move comes as attacks on open source package ecosystems renew attention on how quickly malicious code can spread through developer tools and build pipelines before security teams can respond.

The new controls target the point where software packages enter development environments. New cooldown policies can temporarily hold newly published open source packages before they are made available to developers or CI/CD pipelines, while continuous evaluation is designed to flag risks in packages already stored in an organization's repositories when new threat intelligence emerges.

Artifact repositories sit between public package sources and internal development teams, making them a natural checkpoint for companies seeking more control over software dependencies. Rather than relying only on identifying a threat after a package is already in use, repository-level policies can determine whether a package is available at all.

Repository controls

The new policy templates provide preconfigured policies written in the Rego language, giving customers a starting point for baseline controls. Policy evaluations now run not only when a package is uploaded or threat intelligence changes, but also when a policy is created or updated, removing the need for a separate manual backfill step.

That means changes to internal rules can be applied more quickly across repositories. It also reflects a broader shift in software security toward central policy enforcement, rather than leaving individual teams or pipelines to apply controls separately.

Select customers have already been testing the features, with particular emphasis on the cooldown and malicious package policies. Cloudsmith argues that applying rules at the repository level reduces the chance that a single misconfigured pipeline exposes a wider organization to risk.

The cooldown mechanism is intended to change what developers and automated build systems can see when they query public package registries. It creates a filtered view of upstream package indexes so package managers are presented only with versions that meet internal policy requirements, allowing them to default to the latest compliant version without changing dependency files.

Customer view

One customer cited is Tricentis, which uses Cloudsmith to manage artifacts and identify vulnerabilities across teams and products.

"Cloudsmith is one way in which we identify vulnerabilities and manage artifacts across teams and products we support. It allows us to secure our supply chain by enforcing policies at the registry, which lets us stop malicious packages before they ever reach a developer or a pipeline, and gives us clear and consistent visibility into high and critical vulnerabilities within those packages across the organization," said Christian Jensen, VP of Engineering at Tricentis.

The announcement comes amid mounting concern over software supply chain attacks, especially in open source ecosystems such as npm, where one compromised package can quickly affect large numbers of downstream users. Security specialists have increasingly focused on how compromised credentials, poisoned updates, and malicious packages can spread across build systems before an organization has time to block them.

For companies with large development estates, the issue is not only whether a package is known to be malicious when it is downloaded. It is also whether a package that appears acceptable today is later linked to a threat, creating a need for continuous re-evaluation of software already stored in internal repositories.

Cloudsmith's argument is that this makes the artifact management layer a central place for security and development teams to apply consistent controls. By placing policy checks at the repository, organizations can enforce one set of rules across teams rather than depending on each pipeline or developer environment to maintain the same standards.

Alison Sickelka, the company's VP of Product, said customer adoption of these controls has been rapid.

"We built policy management and continuous risk detection because we believe the artifact management layer is the right place to enforce control over the software supply chain. Security teams are recognizing that centralizing these workflows enhances security, and it shows: this is some of the fastest adoption we've seen from customers, from cooldown policies to our risk detection capabilities. As AI reshapes both sides of the equation - how software gets built and how it is used as an attack vector - teams need a strong boundary to stop unsafe software at the source, along with continuous insight into and control over the software they already use. Today's update delivers that across every team, every pipeline, and every package format," said Sickelka.

Cloudsmith said its platform supports more than 30 package formats and is used to manage software assets and repository policies across development environments.