vlt Reaches 1.0, Launching Hosted Package Registries as a Security-First npm Replacement

vlt, a JavaScript package manager built by npm's original developers, ships 1.0 with hosted registries that block malware and phased installs that stop scripts from running automatically.

Verified pipeline

Sources: 5 Publisher: signed Contributor: signed Hash: 0b45fa4c7a View

Editor's Note · September 7, 2026

Correction:

The article quotes InfoQ as writing that vlt build "runs scripts only for trusted packages," and elsewhere as describing reviewers noting "a quarter remain installable on npm." InfoQ's actual wording is: "vlt build then runs scripts only for the packages you trust, skipping anything flagged as malware by default," and "having flagged more than 275,000 package versions, a quarter of which reviewers note are still installable on npm." Both underlying facts are accurate and consistent with vlt's own announcement; only the exact phrasing inside the quote marks was paraphrased rather than reproduced verbatim from InfoQ.

Clarification:

Two of the five cited sources (vlt.io and news.ycombinator.com) are not in the Machine Herald source allowlist. The chief editor verified each snapshot manually and confirmed every claim attributed to these outlets — including the platform-positioning quote, the phased-install split, the selector list, the malware-flagging and performance figures, the Hacker News point/comment counts, and the founder-attributed pitch quote — is supported verbatim by the cited content. vlt.io is the company's own primary-source product announcement; news.ycombinator.com is the linked public discussion thread. The article is published as-is; the allowlist gap is a separate housekeeping matter.

Overview

vlt, a JavaScript package manager built by npm’s original developers, has shipped version 1.0 alongside general availability of hosted package registries and ecosystem mirrors. According to the announcement, the release positions vlt as “an end-to-end platform for developers, their teams and agents to ship faster, safer, and more reliably,” built as a drop-in replacement for npm.

What We Know

The vlt client can “run your entire package lifecycle through vlt, no npm fallback or dependency required,” according to the announcement, and the company says its registry services remain “backwards compatible with the npm registry API,” supporting npm, pnpm, yarn, bun, and deno for both installing from and publishing into vlt’s hosted registries.
The release introduces phased installations: the vlt install command downloads and extracts packages without running scripts, while a separate vlt build step “run[s] selectively, blocking known malware by default,” according to the announcement. InfoQ describes the same split, noting vlt build “runs scripts only for trusted packages.”
vlt’s dependency graph can be queried with more than 60 selectors, about 30 of which focus on security — including :malware, :cve, :unmaintained, :outdated, :eval, :fs, :license, :vuln, :peer, :diff(), :built, :registry(), :hostname(), and :dist(), according to the announcement. A :host(local) selector extends queries across every project on a single machine, letting a developer run something like vlt query ':host(local) #react:v(<19)' to find every local project still running an older React version.
vlt added “Catalogs,” which let a team define dependency versions once in a vlt.json file and reference them elsewhere with a catalog: tag, and OIDC-based “trusted publishing” that lets CI systems publish to the npm public registry without long-lived tokens — working automatically on GitHub Actions, with GitLab CI and CircleCI supported once their OIDC token is supplied, per the announcement.
On the security side, vlt says it ingests public malware feeds and advisory databases “like OSV so known-bad packages are blocked as they’re discovered by the ecosystem.” The company states it has “flagged over 275k package versions” as malicious, of which “over 25% of them” remain “actively available for download on npm public registry,” according to the announcement. InfoQ reports the same figures, describing reviewers as noting “a quarter remain installable on npm.”
On performance, vlt says “a clean install runs up to 38% faster than npm, no change to your tooling required,” according to the announcement; InfoQ likewise reports the vlt registry as being “up to 38% faster than npm.”
vlt is free and open source, licensed under BSD-2-Clause-Patent, according to the project’s GitHub repository. The project’s license file lists the copyright holder as “vlt technology, Inc.”
The announcement drew attention on Hacker News, where the post logged 55 points and 20 comments, according to the discussion thread. Responding to a question about vlt’s purpose in that thread, a commenter identifying as the company’s founder wrote that vlt “helps engineering teams build JavaScript software faster, reduce supply chain risk, and lower infrastructure costs (via. API perf / payload optimizations).”

What We Don’t Know

vlt has not published independent, third-party benchmark verification of its “38% faster” install claim or its malware-flagging figures; both numbers come from the company’s own announcement.
It is not clear how many organizations have migrated production JavaScript projects to vlt’s hosted registries since the 1.0 launch, or what fraction of the 275,000 flagged package versions were later confirmed malicious by outside researchers.

Context

vlt’s launch follows a broader push across the JavaScript package-manager ecosystem to curb supply-chain attacks. npm itself shipped a major release that disabled install scripts by default after a year of attacks targeting the registry, and other package managers have added their own script-blocking and quarantine mechanisms. vlt’s phased-install model and registry-level malware blocking extend that same trend, but implemented through a company-run hosted registry rather than changes to the npm CLI itself.