TECH Signal 491
Vlt 1.0 and Hosted Package Registries
Vlt 1.0 launches as a stable, npm-compatible package manager alongside a generally available hosted registry that blocks known malware during indexing and serves packages from edge infrastructure.
Teams now have an alternative to npm that combines a security-first client with a hosted registry that proactively blocks malicious packages rather than reacting after distribution. The phased installation model separates downloading from script execution, giving engineers more control over supply chain risk at the point of consumption.
Written by elseif from the cluster below · every claim links back to a sourceThe three things worth knowing
Vlt 1.0 is a drop-in replacement for npm with 60+ graph-native selectors including security-focused ones like :malware:cve, and :unmaintained.
The hosted registry is backwards compatible with the npm registry API and works with npm, pnpm, yarn, bun, and deno for both installing and publishing.
The registry blocks known malware during indexing rather than after delivery, having flagged over 275k package versions with over 25% still actively available on npm's public registry.
THE CLUSTER