The creators of npm have launched vlt 1.0, a JavaScript package manager that blocks known-malicious packages at the registry level and has flagged more than 275,000 package versions, a quarter of which can still be installed through npm. Released this month alongside hosted package registries and ecosystem mirrors, vlt splits installation into two phases to prevent dependency scripts from executing automatically, addressing supply chain security concerns that have plagued the JavaScript ecosystem for years. Founder Darcy Clarke described the client as "built so nothing runs on your machine just because you typed install."
Where npm downloads, extracts, and runs lifecycle scripts in a single step, vlt separates the process into distinct commands. The vlt install command downloads and extracts packages without executing any code, while vlt build runs scripts only for trusted packages and skips anything flagged as malware by default. The tool also introduces vlt query, a dependency selector syntax with more than 60 CSS-like selectors that treats the dependency graph like a DOM tree, with roughly half focused on security through Socket integration. A :host(local) selector extends queries across every project on a machine, and the --view=mermaid flag renders matched dependencies as diagrams. On registry performance, vlt reports speeds up to 38% faster than npm, though pnpm and Bun still lead on raw install speed.
According to Clarke, vlt "helps engineering teams build JavaScript software faster, reduce supply chain risk, and lower infrastructure costs" through API performance and payload optimizations. Responding to a Hacker News commenter who asked for a five-second pitch, Clarke explained that teams spending a disproportionate amount of CI time on cold installs compared to actual builds, or those narrowly escaping malware attacks, should consider the tool. The release comes after a year of supply chain attacks including the Shai-Hulud worm, prompting npm v12 to disable install scripts by default, pnpm to quarantine fresh releases with minimum release ages, and Bun to block postinstall scripts.
The heightened focus on security reflects the growing threat landscape in package ecosystems, where attackers exploit automated script execution during installation to compromise developer machines and CI pipelines. vlt's approach moves beyond client-side protections by rejecting malicious packages before they're served, creating an additional layer of defense that other package managers haven't implemented at the registry level. Migration requires installing vlt globally through npm, then running vlt install and vlt build in existing projects, with configuration shifting from .npmrc to vlt.json and a new vlt-lock.json lockfile. The npm-compatible registry API ensures existing CI pipelines, private registries, and tooling continue functioning without modification.
vlt is available now as free and open source software under a BSD-2-Clause-Patent license, developed by vlt technology inc. and installable with npm i -g vlt, with migration documentation covering the straightforward steps for teams adopting the tool. The launch positions vlt as both a security-first alternative and a drop-in replacement for npm, targeting teams prioritizing supply chain protection alongside installation performance. The architecture that separates downloading from execution represents a fundamental shift in how package managers handle untrusted code, trading the convenience of fully automated installs for granular control over what runs. Organizations weighing the switch will need to balance vlt's registry-level defenses and phased installation model against the operational momentum of existing toolchains, particularly when competitors already match or exceed its speed benchmarks.