Risk detection
Vulnerability scanning
Deprecation
Vulnerability scanning is being replaced by continuous vulnerability detection with OSV, which provides stronger, always-on coverage of vulnerabilities and other supply chain risks.
The functionality described on this page will be deprecated by the end of 2026.
For an overview of the replacement experience, see Risk detection.
Cloudsmith vulnerability scanning automatically scans supported package types for CVEs when a package is uploaded. You can also trigger subsequent scans manually via the Cloudsmith API or Cloudsmith legacy web app.
You can use the results of a Cloudsmith vulnerability scan to drive other actions, such as to quarantine a package, or as part of a package promotion workflow.
Scan results are available through the Cloudsmith legacy web app, the Cloudsmith API, or as a Cloudsmith webhook.
Note
As part of the move to continuous vulnerability detection with OSV.dev, viewing vulnerability scan results and the option to request an additional scan for an individual package are no longer available in the new Cloudsmith web app (app.cloudsmith.com). These actions remain available only in the Cloudsmith legacy web app at cloudsmith.io for the duration of the deprecation period.
Supported formats
Cloudsmith's vulnerability scanning feature is available for the following package formats:
Data sources
Vulnerability scanning detects vulnerabilities in an artifact using the Trivy scanner, which uses TrivyDB as its data source. For supported data sources, see the following table:
| Language / Framework | Source |
|---|---|
| C, C++ | 1. GitLab Advisories Community |
| Dart | 1. GitHub Advisory Database |
| Go | 1. GitLab Security Advisories 2. Go Vulnerability Database |
| Hex | 1. GitHub Advisory Database |
| Java | 1. GitHub Maven Security Advisories 2. GitLab Security Advisories |
| .NET | 1. GitHub .NET Security Advisories |
| Node.js | 1. GitHub NodeJS Security Advisories 2. NodeJS Ecosystem Security Working Group |
| PHP | 1. GitHub PHP Security Advisories 2. Friends of PHP Security Advisories |
| Python | 1. GitHub Python Security Advisories 2. Safety DB |
| Ruby | 1. GitHub Ruby Security Advisories 2. Ruby Advisory Database |
| Rust | 1. RustSec Advisory Database |
| Swift | 1. GitHub Advisory Database |
NVD
| Name | Source |
|---|---|
| National Vulnerability Database | 1. NVD |
If an advisory does not provide severity information, it falls back to NVD's Common Vulnerability Scoring System (CVSS).
Security scan results
The results of a security scan are available from the legacy Cloudsmith web app, the Cloudsmith API, and through a Cloudsmith webhook.
Scan results via the Cloudsmith legacy web app
Vulnerability scan results are available only in the legacy web app at cloudsmith.io. They are not surfaced in the new Cloudsmith web app (app.cloudsmith.com).
You can find an overview of all the packages that have been scanned, or are awaiting an additional scan, on the Security Scanning page in any repository:
The Security Scanning page shows a list of packages scanned, with information about:
- Affected package and version
- Time since last scan
- Number of vulnerabilities found
- Maximum severity of vulnerabilities
For more information and details, you can view the individual vulnerabilities found on the Scans tab on any package detail page.
Scan results via the Cloudsmith API
You can use the Cloudsmith Vulnerabilities API endpoints to return the scan results for an entire organization, a specific repository, an individual package, or a single scan ID.
Scan results via Cloudsmith webhook
See the Cloudsmith Webhooks documentation for details of how to create a webhook and the full range of supported package events.
Performing additional vulnerability scans
You can perform additional vulnerability scans after the upload-time scan using the legacy Cloudsmith web app or the Cloudsmith API.
Additional vulnerability scans via the legacy Cloudsmith web app
Requesting an additional scan for an individual package is only available in the legacy web app at cloudsmith.io. This option is not available in the new Cloudsmith web app.
You can request an additional scan for an individual package from the package details page:
Additional vulnerability scans via the Cloudsmith API
You can request an additional vulnerability scan for a package by using the packages_scan API endpoint.
Early access: recurring vulnerability scans (deprecated)
Recurring vulnerability scans are deprecated and being replaced by continuous malicious package and vulnerability detection, which re-evaluates packages automatically as new threat intelligence arrives. Existing recurring scan configurations will continue to run during the deprecation period; new setups are not being onboarded.
The recurring vulnerability scans Early Access program is closed.
