Integrations

Integrating with RapidFort Curated Libraries

RapidFort Curated Libraries are npm packages filtered through a mandatory cooldown period before becoming available.

Proxy and cache these libraries in Cloudsmith by configuring a RapidFort Curated Libraries upstream.

Upstream configuration

Form Field	Description
Name	A descriptive name for this upstream source. A shortened version of this name will be used for tagging cached packages retrieved from this upstream.
Priority	The weighting of the upstream source. Upstream sources are selected for resolving requests by sequential order (1..n), followed by creation date.
Proxy URL	The URL for this upstream source. This must be a fully qualified URL including any path elements required to reach the root of the repository.
Proxy Only	Proxy requests through to upstream sources in order to match assets that are not present in this repository.
Cache and Proxy	Proxy the initial request for an asset through to the upstream source and then store (cache) resolved assets in this repository for future requests.
Authentication	Select the authentication method required by this upstream. If the upstream does not require credentials, select None from the dropdown.
Headers (optional, under Additional options)	Optional key-value headers that can be passed to upstreams with each request.
Verify SSL Certificates (under Additional options)	If enabled, SSL certificates are verified when requests are made to this upstream. We recommend leaving this enabled for all public sources to help mitigate Man-In-The-Middle (MITM) attacks.

Adding a RapidFort Curated Libraries upstream

You can integrate a RapidFort Curated Libraries registry into your Cloudsmith account by adding a RapidFort upstream.

RapidFort service account credentials
Authentication is required to access RapidFort Curated Libraries. Log in to RapidFort and navigate to Settings > Service accounts to create a service account and retrieve an RF_ACCESS_ID and RF_SECRET_ACCESS_KEY. You will not be able to view these credentials again after creation.

In your Cloudsmith repository, go to the Sources tab.
If you have existing upstreams configured, click + Configure new upstream.
In the modal, select the Libraries tab.
Select RapidFort Curated Libraries.

The form then displays the upstream configuration with npm auto-selected, as it is currently the only available library.
In the Name field, enter a descriptive name for the upstream.
In the Priority field, specify a priority for the upstream.

For more information about upstream priority, see Upstream concepts: Priority.
The Proxy URL field is pre-filled with the RapidFort Curated Libraries URL: https://cdn-cd.rapidfort.io/node/cd.
Under Package delivery, select Cache and proxy.
Under Authentication, select Basic Auth, then enter your RF_ACCESS_ID as the username and RF_SECRET_ACCESS_KEY as the password. This is required for all RapidFort Curated Libraries upstreams.
(Optional) Under Additional options, in the Headers section, add key-value headers to pass to the upstream with each request.
Click + Add upstream.

Your RapidFort Curated Libraries upstream appears on the Upstream registries section of the Sources tab.

Note
RapidFort enforces a mandatory cooldown period (default: 14 days) on newly published package versions. A package version released within this window will not be available through this upstream until it has been scanned and reviewed. If this repository also has a Cloudsmith cooldown policy, the longer of the two cooldown periods applies.

Pull a RapidFort Curated Libraries package

For example, to install an npm package through your RapidFort Curated Libraries upstream:

Configure a Cloudsmith upstream for RapidFort Curated Libraries by using the steps above.
In your Cloudsmith repository, select the Packages tab, then click Push/Pull Packages and choose the npm format.
Follow the steps shown to configure your .npmrc file with your Cloudsmith registry URL and API key.
Run npm install and verify that packages resolve through your Cloudsmith repository.

Verify your setup

After configuring the upstream, confirm that packages are actually being filtered through RapidFort's cooldown window rather than resolving straight from the public npm registry.

Pick a package with a version published within the last 14 days (the default cooldown period). Check its release history on npmjs.com.

Request that specific version through your Cloudsmith repository:

bash

npm view PACKAGE_NAME@LATEST_VERSION --registry=https://npm.cloudsmith.io/WORKSPACE/REPOSITORY/

If the cooldown filter is active, this exact version should fail to resolve (npm view returns a 404; npm install returns ETARGET).
Request the package without pinning a version:
bash
```
npm view PACKAGE_NAME --registry=https://npm.cloudsmith.io/WORKSPACE/REPOSITORY/
```
This should resolve to the most recent version published outside the cooldown window, not the version you tested in step 3.

Check for silent fallback
If you've also configured the public npm registry as a lower-priority upstream on the same repository, a cooldown-blocked version can still resolve through that fallback instead of failing outright. This would silently defeat the purpose of the RapidFort upstream. If you use a fallback upstream, repeat this test with the fallback temporarily disabled to confirm the RapidFort upstream is the one being served.

Updated 6 hours ago