Blog

Design, engineering, and product updates from the vlt team.

RSS feed

Introducing the package registry for JavaScript

August 04announcement

vlt 1.0 & Hosted Package Registries

Stable client release and general availability of hosted JavaScript registries & ecosystem mirrors.

Darcy Clarke CEO

July 30registry

Typosquatting was a spellcheck issue. Slopsquatting is a trust issue.

Dark, cinematic black-and-white photograph of an industrial warehouse conveyor-belt system moving packages

Consuming JavaScript packages safely just got more complicated.

Jen Chan

July 23security

Ship JavaScript? Hang onto your lockfile

Desaturated, grainy close-up of colored pushpins on a map with dramatic backlight and long shadows

Pinning dependencies in package.json won't save you in a supply-chain attack — a committed lockfile does. Here's why, and how to install so it holds.

Jen Chan

July 08open source

Beyond disabling postinstalls: how npm install will change in npm 12

As part of its planned 12th release, the npm CLI drops automatically running lifecycle scripts on installs as part of multiple planned breaking changes

Ruy Adorno Staff Software Engineer

June 23registry

Why Drizzle ORM couldn't publish new releases on NPM for a month

Drizzle ORM recently hit a 100 MB limit in the npm registry and couldn't ship new releases for weeks. What is this limit?

Evert Pot Staff Software Engineer

April 29open source

Doubling Down on Open Source

vlt’s 2025 Open Source Pledge: $14,000 to the ecosystem, $3,500 per engineer.

We've doubled our open source pledge contribution to $14,000 ($3,500 per full-time engineer)

Darcy Clarke CEO

November 19security

Introducing Phased Package Installations

Stop running lifecycle scripts on every install

When you run vlt install, packages are downloaded and extracted to node_modules, but no lifecycle scripts execute.

September 18security

Query Across Projects with host-context

Save Our Ships, query selectors systemwide.

Release subsets of your monorepo with the new version, pack, and publish commands using powerful selectors and a publish directory.

Ruy Adorno Staff Software Engineer

September 04vlt

Interactive Query Building

Compose queries visually in the GUI, without needing to know the dependency selector syntax.

Jason Korol Design Engineer

August 21vlt

Scoped Releases: New version, pack, and publish commands

Scoped Releases: Release with precision using scoped version, pack, and publish commands

Release subsets of your monorepo with the new version, pack, and publish commands using powerful selectors and a publish directory.

Luke Karrys Staff Software Engineer

August 13vlt

Query Powered vlt Commands

'New Feature — Selectors Everywhere: Commands now support powerful dependency filtering across your projects. Example command: vlr --scope='[name^=devtools-]' test.'

Run scripts across your dependency graph using powerful query selectors and the --scope config.

Luke Karrys Staff Software Engineer

August 06vlt

Taking Control with Graph Modifiers

Managing dependencies in complex JavaScript projects just got easier. vlt now offers Graph Modifiers, a new way to take precise control of your dependency graph.

Ruy Adorno Staff Software Engineer

July 30catalogs

Centralized Dependency Management Made Simple

We are excited to share catalog support - a powerful new feature for centralized dependency management that reduces duplication and simplifies version orchestration across your projects.

Darcy Clarke CEO

May 27vlt

Introducing `jsr:` Support

Isaac Schlueter

May 09vlt

Introducing the new `exec` and `exec-cache` commands

Introducing the new `vlt exec` and `vlt exec-cache` commands

Introducing the New `vlt exec` Command

Isaac Schlueter

April 17insights

Package Insights Selectors Powered by Socket

Unlock deep, actionable insights into your dependencies with vlts new security-first selectors — powered by metadata from Socket.

Ruy Adorno Staff Software Engineer

February 26vlt

Reproducibility vs. Provenance: Trusting the JavaScript Supply Chain

We launched a new tool to detect package integrity issues in the JavaScript ecosystem. Learn how `reproduce` is changing the game.

Darcy Clarke CEO

February 13vlt

Fresh New GUI Features

We are excited to announce some new gui features!

A look under the hood of a vlt install.

Jason Korol Design Engineer

February 04conference

HalfStack Phoenix Recap

Luke standing in front of a large slide showing a screenshot of the vlt gui.

Recapping the HalfStack Phoenix conference.

Luke Karrys Staff Software Engineer

November 21recap

NodeConf EU and Collab Summit Recap

Recapping the vlt team's week in Ireland.

Luke Karrys Staff Software Engineer

November 05vlt

Introducing the vlt Package Manager & Serverless Registry

Announcing our foundational Package Manager Client & Serverless Registry.

October 08sustainability

Making Open Source More Sustainable

We are excited to announce our Open Source Pledge!

vlt joins Sentry, Astral, Val Town & more in contributing back to the open source ecosystem!

Darcy Clarke CEO

June 17team

vlt i @lukekarrys

Luke Karrys joins vlt!

Luke Karrys Staff Software Engineer

June 13conference

Collision Conf 2024: Join vlt in Toronto!

We are headed to Collision Conference 2024 in Toronto!

Join vlt in Toronto for Collision Conf 2024!

Darcy Clarke CEO

March 20team

Introducing our team, investors & more...

The founding team, from left to right: Isaac Z. Schlueter, Darcy Clarke and Ruy Adorno

We put together an incredible team, with top-notch investors & a bold product vision.

Darcy Clarke CEO

June 27security

The massive bug at the heart of the npm ecosystem

An article detailing the massive bug at the heart of the npm ecosystem; encompassing a lack of validation by the public registry, package manifest inconsistancies & assumptions about package managers & security products

Darcy Clarke CEO

Blog

Command Palette