---
id: 6710
title: "Why Cloudsmith Is a Risk You Can’t Afford: A Wake-Up Call on Superficial Software Supply Chain Security"
source_domain: jfrog.com
source_url: "https://jfrog.com/blog/pitfalls-of-superficial-application-security/"
published_at: "2025-06-24T13:09:08Z"
tags: ["supply-chain", "devsecops", "jfrog", "false-positives", "software-supply-chain", "sca", "cloudsmith"]
phying_url: "https://phying.com/item/6710"
lang: en
---

# Why Cloudsmith Is a Risk You Can’t Afford: A Wake-Up Call on Superficial Software Supply Chain Security

## Summary

JFrog's security research team benchmarks Cloudsmith's supply chain security offering, alleging it thinly wraps an outdated open-source scanner with 24 known vulnerabilities, misses well-known malicious packages, and floods a single image with 3,000+ false positives while lacking core DevSecOps coverage.

## Intelligence Metadata

- **Sources:** jfrog.com
- **Published:** 2025-06-24T13:09:08Z
- **Original:** https://jfrog.com/blog/pitfalls-of-superficial-application-security/
- **Phying News:** https://phying.com/item/6710