Documentation
Book a demo

Supply chain security

Package quarantine

With package quarantine, you can temporarily block downloads of a package until you release it from quarantine.

This is useful in any case where you wish to remove the ability to access a package that is present in your Cloudsmith repository, for example, in a case where a security vulnerability is discovered after you have published a package. Unlike deleting a package, you can restore access to the specified package at a later stage if required.

We provide the ability to quarantine a package in three ways:

In the following examples:

IdentifierDescription
OWNERYour Cloudsmith account or workspace name (namespace)
REPOSITORYYour Cloudsmith repository name (also called "slug")
PACKAGEThe unique identifier for a package. For more details, see Package identification.

Quarantine via the Cloudsmith web app

Add to quarantine

You can quarantine a package by using the Quarantine button on the package Overview tab, or from the Packages tab by using the package actions menu:

After you have quarantined a package, the synchronization status will change from "Completed" to "Quarantined".

Release from quarantine

You can remove a package from quarantine by using the Unquarantine action on the Packages tab or on the Overview tab for the package.

To remove a package from quarantine, go to the Overview tab for the package, click to expand the actions menu next to Quarantined, and click Unquarantine.

Policy as code

If the package was quarantined by a policy, releasing it manually will not prevent re-quarantine. Policies re-evaluate in response to several Policy triggers and on a schedule. If a package still matches the policy conditions, it will be re-quarantined.

You can also bulk unquarantine packages from the packages list views at the repository or workspace level:

Quarantine via the Cloudsmith CLI

You can quarantine packages via the Cloudsmith CLI by using the cloudsmith quarantine command.

Before you can add or remove a package from quarantine via the CLI, you must identify the package. See Package identification for full instructions on identifying packages.

Add to quarantine

To quarantine a package, use the cloudsmith quarantine add command:

bash
cloudsmith quarantine add OWNER/REPOSITORY/PACKAGE

For example:

bash
cloudsmith quarantine add demo/examples-repo/IB6FYhIvaoAy

Release from quarantine

To release a package from quarantine, use the cloudsmith quarantine remove|rm|restore command:

bash
cloudsmith quarantine remove OWNER/REPOSITORY/PACKAGE

For example:

bash
cloudsmith quarantine remove demo/examples-repo/IB6FYhIvaoAy

Quarantine via the Cloudsmith API

Please see the Cloudsmith Interactive API reference for details on the Quarantine Package API endpoint.

Client behavior

When a quarantined package is requested by native tooling e.g. pip install, mvn install, npm install, etc., the repository returns HTTP 403 Forbidden. Builds will fail with a 403 error such as:

ERROR: HTTP error 403 while getting <https://dl.cloudsmith.io/…/requests-2.6.1…>

This message confirms that a package is quarantined.

Enhanced 403 error messaging with policy as code

For supported package managers, Cloudsmith returns a customizable error message to the native client when a package is quarantined due to a policy. The message is returned as part of the standard 403 response body and surfaced directly by the package manager, with no client-side configuration required.

The message includes:

  • Policy name: The name of the policy that matched the package.
  • Policy description: The policy description field, which you can use to include internal guidance — for example, who to contact, or a link to internal documentation.
  • Policy ID: The unique identifier for the policy action, for reference and troubleshooting.

Supported package managers:

  • uv (Python)
  • npm
  • Docker
  • Maven