The vlt platform has officially launched version 1.0, introducing a security-focused JavaScript package manager alongside hosted registry services designed to provide faster, safer dependency management for modern development teams.

Key Points

• The vlt client serves as a drop-in replacement for npm, supporting existing workflows while offering up to 38% faster installation speeds.
• The platform features over 60 graph-native pseudo selectors, including specialized tools to identify malware, outdated dependencies, and unmaintained packages.
• New infrastructure provides OIDC "trusted publishing," allowing developers to publish packages from CI environments like GitHub Actions without using long-lived tokens.
• Hosted registries are backwards compatible with npm, pnpm, yarn, bun, and Deno, ensuring seamless integration with current JavaScript tooling.
• The service actively monitors and blocks malicious packages in real-time, having already flagged over 275,000 package versions that remain available on the public npm registry.

Why it Matters

By providing a security-first alternative to the standard npm registry, vlt addresses critical supply chain vulnerabilities that often plague modern software development. This platform enables teams to adopt faster, agent-native workflows while maintaining strict control over dependency integrity and installation performance.