New package manager vlt 1.0 blocks malware at registry and splits install/build steps

vlt 1.0 changes the package management workflow by splitting the traditional npm install into two distinct phases: vlt install downloads and extracts packages without executing any lifecycle scripts, and vlt build runs scripts only for packages that are explicitly trusted. This phased approach prevents automatic execution of potentially malicious code during dependency acquisition. In addition, vlt provides a queryable dependency graph that treats the package tree like a DOM tree, offering more than 60 CSS-like selectors for inspection. The --view=mermaid flag can render matched dependencies as a diagram for visual analysis.

Adopting vlt requires running npm install -g vlt to make the command available globally, after which existing projects can use vlt install and vlt build in place of npm install. Configuration moves from the familiar .npmrc file to a vlt.json file, and a new vlt-lock.json lockfile is generated to record exact versions. Because vlt implements the npm-compatible registry API, current CI pipelines, private registries, and tooling continue to operate without modification. The migration guide notes that the steps are small and fairly straightforward for teams already using npm.

While vlt emphasizes security, its raw installation speed does not lead the field; the project reports its registry as up to 38 % faster than npm but acknowledges that pnpm and Bun still achieve faster overall install times. The malware-blocking feature depends on the registry’s ability to flag known-bad versions, which currently covers more than 275,000 releases, yet a quarter of those flagged packages remain installable on the public npm registry, indicating a gap between the two ecosystems. The query functionality relies on a Socket integration for its security-focused selectors, meaning teams must trust that external service for accurate threat data. Consequently, vlt may not replace tools where raw speed or full independence from third-party security feeds is a primary requirement.

vlt is released as free and open source software under a BSD-2-Clause-Patent license, developed by vlt technology inc., and can be installed directly from npm with the command npm i -g vlt. By offering a drop-in replacement that separates installation from script execution and blocks malicious packages at the registry, it aims to lower supply-chain risk and infrastructure costs for JavaScript teams. The npm-compatible API ensures that existing workflows can continue while gaining the added security controls.