vlt, the JavaScript package manager and registry built by the original creators of npm, has released vlt 1.0, shipping as a drop-in npm replacement alongside the general availability of its hosted package registries and ecosystem mirrors.
vlt 1.0 introduces several capabilities, including phased installations that stop dependency scripts from running automatically, a queryable dependency graph with more than 60 CSS-like selectors, and hosted registries that reject known-malicious packages before they are served. Founder Darcy Clarke announced the release on X, describing a client "built so nothing runs on your machine just because you typed install."
Where npm downloads, extracts, and runs lifecycle scripts in one step, vlt splits the process in two. vlt install downloads and extracts packages without executing anything, and vlt build then runs scripts only for the packages you trust, skipping anything flagged as malware by default:
$ vlt install # downloads packages, no scripts run
$ vlt build # runs approved scripts, blocks known malware
The second standout is vlt query, a dependency selector syntax that treats the graph like a DOM tree. Around half of the 60-plus selectors are security focused and powered by a Socket integration, letting teams audit dependencies at scale, while a :host(local) selector extends queries across every project on a machine. The --view=mermaid flag renders the matched dependencies as a diagram.
On Hacker News, where the launch reached the front page, one commenter welcomed it as something that "will benefit the entire ecosystem," while others struggled with the pitch, with one asking plainly what the service is and to "pitch me in five seconds or less.", to which Clarke responded:
5s: save time & money
10s: vlt helps engineering teams build JavaScript software faster, reduce supply chain risk, and lower infrastructure costs (via. API perf / payload optimizations).20s: If you've used npm for years & are just narrowly escaping the various malware attacks or are on the hook for running up CI/agent bills at work because cold installs are X percent of the time compared to your actual builds/runtime, then you should check us out.
After a year of supply chain attacks such as the Shai-Hulud worm, npm v12 now disables install scripts by default, pnpm quarantines fresh releases with a minimum release age, and Bun blocks postinstall scripts too. vlt goes further by rejecting bad packages at the registry, having flagged more than 275,000 package versions, a quarter of which reviewers note are still installable on npm. On raw install speed, though, pnpm and Bun still lead, and vlt reports its registry as up to 38% faster than npm rather than the fastest overall.
For developers who are interested, migrating steps are small and fairly straightforward. After npm install -g vlt, teams can run vlt install and vlt build in an existing project, with configuration moving from .npmrc to vlt.json and a new vlt-lock.json lockfile, as covered in the migration guide. The npm-compatible registry API means existing CI pipelines, private registries, and tooling keep working.
vlt is free and open source under a BSD-2-Clause-Patent license, developed by vlt technology inc. and available now with npm i -g vlt.