Ship JavaScript? Hang onto your lockfile

vlt /vōlt/

    • PricingDocs (opens in new window)Benchmarks (opens in new window)
Sign UpLog In
Open Source
  • Package Manager
  • Serverless Registry
  • Policies
  • Reproduce
  • Packages & Ecosystem
Platform
  • Packages
  • Projects
Resources
  • Blog
  • Press
  • Brand Kit
  • Benchmarks
  • Documentation
Company
  • About
  • Careers
  • Status
  • Contact
© 2026 vlt technology inc, All rights reserved
  • Terms
  • Privacy
  • Security
All Systems Operational
    • A hero image depicting ascii characters arranged in an organic wave-like pattern
    1.0.0-rc.32 Jun 3, 2026

    Package registries
    for teams that move fast

    Secure your installs and ship faster all without changing your developer tooling.

    Start Publishing
    Schedule a Call

    Time is money
    And your time is valuable

    Save time and money
    without even changing your tools

    CI Savings at Scale100K installs / mo
    Installs / moSavings / yr
    25k100M
    100K
    origin installs / mo
    ~368 hrs
    CI time saved / mo
    ~$4.2K
    saved / yr

    Estimated on GitHub Actions 4-core runner pricing.

    76% smaller packuments

    Less bandwidth and smaller caches.

    vlt
    ~228 MB
    npm
    ~952 MB

    Top 10k packages averaged (gzip)

    73% faster installs

    Cuts CI compute time with every install.

    vlt
    1.3s
    npm
    4.8s

    Astro project installation

    Benchmark
    38% faster registry

    Faster installs without changing tools.

    vlt
    12.0s
    npm
    19.4s

    Astro project installation

    Benchmark

    Latest News

    July 23security

    Ship JavaScript? Hang onto your lockfile

    Desaturated, grainy close-up of colored pushpins on a map with dramatic backlight and long shadows

    Pinning dependencies in package.json won't save you in a supply-chain attack — a committed lockfile does. Here's why, and how to install so it holds.

    Jen Chan

    July 08open source

    Ready to build
    something extraordinary?

    $curl-fsSLhttps://install.vlt.sh|bash

    Beyond disabling postinstalls: how npm install will change in npm 12

    npm 12 breaking changes banner

    As part of its planned 12th release, the npm CLI drops automatically running lifecycle scripts on installs as part of multiple planned breaking changes

    Ruy Adorno Staff Software Engineer

    June 23registry

    Why Drizzle ORM couldn't publish new releases on NPM for a month

    Package publish version banner

    Drizzle ORM recently hit a 100 MB limit in the npm registry and couldn't ship new releases for weeks. What is this limit?

    Evert Pot Staff Software Engineer