vlt 1.0 Brings Phased Installs and a Queryable Dependency Graph to the npm World

On September 7, 2026, vlt, the JavaScript package manager and registry built by the original creator of npm, Darcy Clarke, shipped version 1.0 with general availability of its hosted registries and ecosystem mirrors. The project is positioned as a drop-in replacement for npm, the package manager that has anchored the JavaScript and Node.js ecosystem for more than a decade, and the 1.0 milestone turns a long-running experiment into a product with a security story aimed squarely at the weaknesses exposed by a year of high profile supply chain attacks.

Key Facts

InfoQ reported on September 7 that vlt 1.0 introduces phased installations, a mechanism that stops dependency scripts from running automatically during an install. Clarke described the client as one built so that nothing runs on a developer's machine just because they typed install. In practice the flow is split into two explicit steps: vlt install downloads and extracts packages without executing anything, and vlt build then runs scripts only for packages a team trusts, skipping anything flagged as malware by default.

InfoQ reported on September 7 that vlt adds a queryable dependency graph with more than 60 CSS-like selectors. The syntax treats the dependency tree like a document object model, and roughly half of the selectors are security focused and powered by an integration with Socket, a software supply chain security firm. A :host(local) selector extends queries across every project on a machine, and a view option set to mermaid renders the matched dependencies as a diagram for visual audits of a dependency tree.

InfoQ reported on September 7 that vlt's hosted registries reject known-malicious packages before they are served to users. The registry has already flagged more than 275,000 package versions, and reviewers note that a quarter of those flagged versions are still installable on npm itself, a gap that vlt turns into a central differentiator for security conscious teams.

InfoQ reported on September 7 that the migration path is deliberately small. Developers run npm install -g vlt, configuration moves from the familiar .npmrc file to one named vlt.json, a new vlt-lock.json lockfile replaces the previous lockfile format, and an npm-compatible registry API keeps existing CI pipelines, private registries, and tooling working without rewrites.

InfoQ reported on September 7 that vlt is free and open source under a BSD-2-Clause-Patent license and is developed by vlt technology inc. The release landed at the end of a year in which npm v12 disabled install scripts by default, pnpm began quarantining fresh releases with a minimum release age, and Bun blocked postinstall scripts, a wave of defensive changes driven by incidents such as the Shai-Hulud worm.

Analysis

The bigger picture here is that vlt is trying to move the security conversation about JavaScript dependencies from the developer's machine to the registry itself. Install scripts have long been one of the most dangerous parts of the npm model because a package can execute arbitrary code the moment it is fetched, before anyone has read its source. npm, pnpm, and Bun have all reacted by restricting when scripts are allowed to run, but those rules are enforced client side on each individual machine. vlt's bet is that rejecting bad packages at the registry, before they are ever served, protects every downstream user at once rather than requiring each team to configure its own defenses and keep them current.

What this really means is that vlt is competing on trust and auditability rather than on raw speed. The launch coverage notes that pnpm and Bun still lead on raw install speed, while vlt claims its registry is up to 38 percent faster than npm rather than the fastest option overall. For a team that has never been hit by a malicious dependency, raw speed will matter more than a security architecture they hope never to exercise. For an enterprise that has felt the pain of a compromised package, or that pays large CI and agent bills because cold installs consume most of the build cycle, the two phase model and registry level blocking are concrete and defensible benefits.

The structure of the release also reveals who vlt expects to win over. The pitch quoted in the coverage is aimed at engineering leaders who are narrowly escaping malware attacks or who are responsible for runaway CI and agent costs, not at solo developers content with npm's defaults. That focus on the economic buyer rather than the individual developer mirrors a broader shift in open source infrastructure, where the organizations that pay for tooling are increasingly the ones deciding which tools get standardized across a company.

The tension vlt is navigating is that security and convenience have historically pulled in opposite directions. The original npm model won because it was effortless: a developer typed install and everything, including build scripts, simply ran. Every restriction added since, whether it is npm disabling install scripts by default, pnpm holding back fresh releases, or vlt splitting install from build, asks developers to give up a little convenience in exchange for protection. vlt's wager is that the industry has reached a point where the trade is acceptable, and that teams burned by a supply chain incident will not only accept it but begin to demand it as table stakes. That is why the phased installation model matters more than any single selector in the query language: it changes the default relationship between a developer and the code that runs on their machine.

Why It Matters

The JavaScript ecosystem has been shaken by a series of supply chain incidents, and the response has mostly been reactive: stricter defaults in npm, quarantine windows in pnpm, postinstall blocking in Bun. vlt 1.0 matters because it is a proactive alternative built by the person who originally created npm, which lends it a credibility that a newcomer would struggle to earn. Clarke's authorship means the project can make compatibility claims about the registry API and lockfile behavior with authority, and it helps explain why the migration path has been designed to be almost frictionless for existing npm projects.

Registry level malware rejection is also a meaningful escalation in how the industry thinks about defense. Even a well configured client cannot protect a developer who installs a malicious package that has not yet been flagged anywhere, but a registry that refuses to serve known bad versions removes that entire class of mistake for everyone who uses it. If vlt's approach proves out in production, it could push the rest of the ecosystem to treat package hosting as a security boundary rather than a passive file server, which would raise the baseline of safety for the millions of projects that depend on JavaScript tooling every day. The fact that a quarter of the versions vlt has flagged remain installable on npm is a reminder that the default toolchain still has a gap, and that gap is exactly the opening vlt is targeting.

Next Up

The near term question is adoption. vlt is available now through npm install -g vlt, so the cost of trying it in an existing project is low, and the open source license removes a procurement hurdle for individual developers. The more important test will be whether large organizations, the ones with the CI bills and the compliance requirements, standardize on vlt, and whether the hosted registries attract enough paying traffic to sustain the company behind it.

Competitors will not stand still. npm is maintained within the GitHub and Microsoft ecosystem, and the registry level security posture vlt is selling could quickly become a feature request aimed at the default toolchain. Watch for pnpm and Bun to answer with their own security enhancements, and for the dependency graph querying model to influence how other package managers present audit information. In the meantime, developers who want dependency scripts to stop running on their machines without explicit approval can try vlt today and measure whether the two phase workflow costs them more time than it saves in peace of mind.