Blab Tech
vlt 1.0 Launches as npm-Compatible Package Manager with Phased Installations and Built-In Malware Blocking
On September 7 2026, the original npm team unveiled vlt 1.0, a drop‑in replacement for npm that ships as a free, open‑source project under a BSD‑2‑Clause‑Patent license.
vlt’s hallmark is a two‑step installation workflow. The first command, vlt install, pulls and extracts packages but deliberately skips any lifecycle scripts. The second command, vlt build, runs scripts only for packages that the user has explicitly approved, and it blocks any package that the registry has flagged as malicious. The design is meant to stop accidental execution of harmful code during dependency resolution.
Beyond phased installs, vlt offers a queryable dependency graph. The vlt query command accepts CSS‑style selectors that filter packages by name, version, or security status. With more than 60 selectors—many of which focus on security—teams can audit dependencies at scale. A real‑time integration with Socket powers the query engine, and a special selector, :host(local), expands queries across all projects on a machine. Adding the --view=mermaid flag renders the matched dependencies as a diagram.
The vlt registry rejects known malicious packages before they reach a client. Project data show that over 275,000 package versions have been flagged, and about a quarter of those remain installable on npm. Benchmarks released by vlt indicate that its registry can be up to 38 % faster than npm for certain workloads, although pnpm and Bun still lead on raw install speed.
Migrating from npm to vlt is straightforward. After installing the client with npm i -g vlt, developers can run vlt install and vlt build in an existing project. Configuration files move from .npmrc to vlt.json, and a new lockfile, vlt-lock.json, is created. Because the registry API is npm‑compatible, existing CI pipelines, private registries, and tooling continue to work without modification.
Founder Darcy Clarke announced the release on X, stressing that the client is built so “nothing runs on your machine just because you typed install.” He also offered a concise pitch: a 5‑second version highlighting time and cost savings, a 10‑second version describing how vlt helps engineering teams build faster and reduce supply‑chain risk, and a 20‑second version targeting teams that have experienced malware attacks or high CI costs.
vlt’s timing aligns with a broader industry focus on supply‑chain security. In 2026, npm’s upcoming v12 version disables install scripts by default, pnpm quarantines new releases for a minimum age, and Bun blocks post‑install scripts. The 2025 Shai‑Hulud worm, a supply‑chain attack that surfaced that year, underscored the need for stricter controls. By rejecting malicious packages at the registry level, vlt adds an additional layer of protection.
The launch drew attention on Hacker News, where the front‑page post sparked mixed reactions. Some commenters welcomed the new tool as a benefit for the ecosystem, while others asked for a clearer explanation of the service. The discussion illustrates that, while the concept of a safer package manager is widely appreciated, the practical details of its adoption are still being evaluated by developers.
vlt is distributed through npm and can be installed with npm i -g vlt. The project’s documentation includes a migration guide, a detailed explanation of the query syntax, and performance benchmarks. The release marks a significant step toward more secure and predictable JavaScript dependency management, though its long‑term impact on the ecosystem remains to be seen as teams experiment with the new workflow.
vlt’s hallmark is a two‑step installation workflow. The first command, vlt install, pulls and extracts packages but deliberately skips any lifecycle scripts. The second command, vlt build, runs scripts only for packages that the user has explicitly approved, and it blocks any package that the registry has flagged as malicious. The design is meant to stop accidental execution of harmful code during dependency resolution.
Beyond phased installs, vlt offers a queryable dependency graph. The vlt query command accepts CSS‑style selectors that filter packages by name, version, or security status. With more than 60 selectors—many of which focus on security—teams can audit dependencies at scale. A real‑time integration with Socket powers the query engine, and a special selector, :host(local), expands queries across all projects on a machine. Adding the --view=mermaid flag renders the matched dependencies as a diagram.
The vlt registry rejects known malicious packages before they reach a client. Project data show that over 275,000 package versions have been flagged, and about a quarter of those remain installable on npm. Benchmarks released by vlt indicate that its registry can be up to 38 % faster than npm for certain workloads, although pnpm and Bun still lead on raw install speed.
Migrating from npm to vlt is straightforward. After installing the client with npm i -g vlt, developers can run vlt install and vlt build in an existing project. Configuration files move from .npmrc to vlt.json, and a new lockfile, vlt-lock.json, is created. Because the registry API is npm‑compatible, existing CI pipelines, private registries, and tooling continue to work without modification.
Founder Darcy Clarke announced the release on X, stressing that the client is built so “nothing runs on your machine just because you typed install.” He also offered a concise pitch: a 5‑second version highlighting time and cost savings, a 10‑second version describing how vlt helps engineering teams build faster and reduce supply‑chain risk, and a 20‑second version targeting teams that have experienced malware attacks or high CI costs.
vlt’s timing aligns with a broader industry focus on supply‑chain security. In 2026, npm’s upcoming v12 version disables install scripts by default, pnpm quarantines new releases for a minimum age, and Bun blocks post‑install scripts. The 2025 Shai‑Hulud worm, a supply‑chain attack that surfaced that year, underscored the need for stricter controls. By rejecting malicious packages at the registry level, vlt adds an additional layer of protection.
The launch drew attention on Hacker News, where the front‑page post sparked mixed reactions. Some commenters welcomed the new tool as a benefit for the ecosystem, while others asked for a clearer explanation of the service. The discussion illustrates that, while the concept of a safer package manager is widely appreciated, the practical details of its adoption are still being evaluated by developers.
vlt is distributed through npm and can be installed with npm i -g vlt. The project’s documentation includes a migration guide, a detailed explanation of the query syntax, and performance benchmarks. The release marks a significant step toward more secure and predictable JavaScript dependency management, though its long‑term impact on the ecosystem remains to be seen as teams experiment with the new workflow.
