Proxying public registries safely

Proxying means your developers and pipelines pull open-source dependencies through Cloudsmith rather than directly from a public registry. Depending on the upstream mode, Cloudsmith can cache packages to protect builds from upstream outages. The controls below add trust, cooldown, and scanning protections.

This guide steps through setting up an upstream and then layering the controls that make it safe. Each step links to the detailed documentation for that topic.

Step 1: add an upstream

Configure the public registry you want to proxy, and choose whether Cloudsmith caches packages or only proxies them.

Step 2: protect your private package names

Upstream trust stops a public package from impersonating one of your private package names, while open-source packages that don't collide keep resolving as normal. It is in early access and currently supports npm, Python, and Maven.

Step 3: hold back brand-new versions

A cooldown policy hides newly published versions until they reach a minimum age, allowing time for malware detection and community scrutiny.

Step 4: detect malicious packages

Cloudsmith scans proxied packages for malware, separately from known-vulnerability scanning.

Step 5: block anything unscanned

Block until scan requires packages from upstreams to finish scanning and policy evaluation before anyone can download them.

Updated 3 minutes ago