Why Cloudsmith Is a Risk You Can’t Afford: A Wake-Up Call on Superficial Software Supply Chain Security

JFrog's security research team benchmarks Cloudsmith's supply chain security offering, alleging it thinly wraps an outdated open-source scanner with 24 known vulnerabilities, misses well-known malicious packages, and floods a single image with 3,000+ false positives while lacking core DevSecOps coverage.