Supply chain security
Risk detection
Risk detection surfaces security and compliance issues in your repositories before they reach builds, downloads, or downstream consumers.
Detection runs automatically on upload of an artifact, and continuously thereafter for malicious package and vulnerability detection.
Note
Risk detection identifies issues. To quarantine, delete, or tag packages based on detection results, see Policy management.
Cloudsmith covers four categories of risk:
- Malware scanning: Signature-based inspection of artifact contents for known malware using ClamAV.
- Malicious package detection: Matches packages against the OpenSSF Malicious Packages dataset distributed via OSV.dev, catching known threats such as typosquats, dependency confusion, and compromised maintainer releases.
- Vulnerability detection: Matches packages against known vulnerabilities aggregated by OSV.dev, an open-source vulnerability database that consolidates records from sources including GitHub Security Advisories (GHSA) and language and Linux-specific vulnerability databases.
- License detection: Identifies the license declared by each package so you can review license exposure across your workspace.
How detection fits into your workflow
Each detection type runs at package ingest and produces structured metadata attached to the artifact. You can consume that metadata in three ways:
- Review in the Cloudsmith web app: View the security and compliance status of your packages at the workspace, repository, and package level.
- Query through the Cloudsmith API: Detection results are available through the Cloudsmith API.
- React automatically: Integrate detection events into policies to quarantine, tag, or delete on detection.
