
Security News
Federal Government Rescinds Software Supply Chain Mandates, Makes SBOMs Optional
The U.S. government is rolling back software supply chain mandates, shifting from mandatory SBOMs and attestations to a risk-based approach.
@dotcom-tool-kit/cloudsmith
Advanced tools
With Tool Kit [already set up](https://github.com/financial-times/dotcom-tool-kit#installing-and-using-tool-kit), install this plugin as a dev dependency:
With Tool Kit already set up, install this plugin as a dev dependency:
npm install --save-dev @dotcom-tool-kit/cloudsmith
And add it to your repo's .toolkitrc.yml:
plugins:
- '@dotcom-tool-kit/cloudsmith'
@dotcom-tool-kit/cloudsmith| Property | Description | Type |
|---|---|---|
serviceAccount | the Cloudsmith service account. this will probably be your team name followed by the permissions access, e.g., cp-reliability-read-write. | string |
All properties are optional.
FAQs
With Tool Kit [already set up](https://github.com/financial-times/dotcom-tool-kit#installing-and-using-tool-kit), install this plugin as a dev dependency:
The npm package @dotcom-tool-kit/cloudsmith receives a total of 736 weekly downloads. As such, @dotcom-tool-kit/cloudsmith popularity was classified as not popular.
We found that @dotcom-tool-kit/cloudsmith demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 3 open source maintainers collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
The U.S. government is rolling back software supply chain mandates, shifting from mandatory SBOMs and attestations to a risk-based approach.

Security News
crates.io adds a Security tab backed by RustSec advisories and narrows trusted publishing paths to reduce common CI publishing risks.

Research
/Security News
A Chrome extension claiming to hide Amazon ads was found secretly hijacking affiliate links, replacing creators’ tags with its own without user consent.