Build my stack
Major Release
vlt Blog: vlt 1.0 & Hosted Package Registries
Aug 4, 2026
- vlt 1.0 is now stable, marking the first major release from the team that originally built npm. Full-featured, security-first JavaScript package manager.
- Hosted JavaScript package registries (vsr) are generally available, letting teams run private registries with full npm compatibility and ecosystem mirrors.
- Built-in security scanning, lockfile integrity verification, and provenance checking ship as default behaviors, not opt-in plugins.
- Novel query syntax lets developers and AI agents programmatically inspect dependency trees, find vulnerabilities, and audit license compliance from the CLI.
vlt, the JavaScript package manager built by npm's original creators, announced its stable 1.0 release on August 4, 2026, alongside the general availability of hosted package registries and ecosystem mirrors. The release marks vlt's transition from promising upstart to production-ready infrastructure.
The pitch is straightforward: npm's architecture was designed in 2010. JavaScript development in 2026 involves AI agents writing code, monorepos with thousands of packages, and security requirements that didn't exist a decade ago. vlt rebuilds the package manager from scratch for this reality.
What Ships in 1.0
The CLI is a complete package manager: install, publish, run scripts, manage workspaces. But the differentiators are security defaults and a query engine. Security scanning, lockfile integrity checks, and provenance verification happen automatically on every install. No configuration, no plugins, no forgetting to enable it.
The query syntax is particularly interesting for AI-assisted workflows. Agents can run structured queries against the dependency tree to find packages matching specific criteria: outdated versions, known CVEs, restrictive licenses, or unused dependencies. This makes dependency management automatable in ways npm never supported.
Hosted Registries and Ecosystem Mirrors
vsr (vlt server registry) is now generally available as a hosted service. Teams get private npm-compatible registries that can mirror the public ecosystem, cache packages for reliability, and enforce publishing policies. Think GitHub Packages or Artifactory, but purpose-built for the vlt ecosystem with tighter security guarantees.
Ecosystem mirrors solve the "left-pad problem" at the infrastructure level. If a public package is unpublished or compromised, your mirror retains the last-known-good version. For enterprises running CI/CD at scale, this eliminates an entire class of supply chain risks.
How It Compares to npm, pnpm, and Bun
vlt doesn't compete purely on speed (Bun still wins raw install benchmarks). Its edge is the security-by-default posture and the query engine for programmatic dependency management. For teams where supply chain security matters more than shaving 2 seconds off installs, vlt 1.0 is the first package manager that treats security as a core primitive rather than an afterthought.
The hosted registry adds a business model that npm (now owned by GitHub/Microsoft) and pnpm lack. Whether the JavaScript ecosystem has room for another registry provider alongside npm, GitHub Packages, and JSR remains the open question.
Frequently Asked Questions
Is vlt compatible with existing package.json and npm packages?
Yes. vlt reads standard package.json files and installs from the npm registry by default. Migration from npm or pnpm requires zero configuration changes.
How does vlt's query syntax work?
Run structured queries like `vlt query ':semver(>=2.0.0):license(MIT)'` to filter your dependency tree by version, license, author, vulnerability status, or custom predicates.
What does the hosted registry cost?
Free tier for small teams with limited storage. Paid plans start at $29/month for teams with higher storage, custom domains, and advanced access controls.
Who built vlt?
Founded by Isaac Z. Schlueter (npm creator), Darcy Clarke, Ruy Adorno, and other former npm team members. The team has deep knowledge of registry operations at scale.
Kevin Hartnett covers developer tools, coding environments, and the infrastructure that powers modern software teams. He built production software for 10 years before switching to journalism.
