JavaScript package registries
for teams that move fast
Publish scoped and private packages, manage organizations and access, and give every developer and CI environment a consistent source for public and private JavaScript dependencies.
Packages indexed
Versions indexed
Malware blocked
A better registry
vlt is built around the JavaScript dependency graph from the ground up, making package delivery faster, safer, and easier to understand and control.
JavaScript packages are not idempotent artifacts; they form enormous, dynamic dependency graphs that affect every install, build, and deployment. Most registries are glorified S3 buckets designed to store files statically - not leveraging any understanding of dependent relationships or linking critical associative metadata.
Move fast
without changing your tools
vlt serves npm-compatible packages through infrastructure purpose-built for JavaScript package distribution. Fine-tuned caching, smaller payloads, and faster CI—all while remaining fully compatible with the tools your team already uses.
packuments delivered
Less bandwidth and smaller caches.
Top 10k packages averaged (gzip)
package installs
Cuts CI compute time with every install.
Astro project installation
Benchmarkregistry performance
Faster installs without changing tools.
Astro project installation
BenchmarkInstalling registry packages
70% faster installing packages compared to traditional tools from the npm registry
Executing scripts
Run your package scripts with vlr, targeting a single project or an entire workspace
Cataloging dependencies
Organize your dependencies, and catalog them to keep your codebase simple
npm registry
$npminstallnext
⠋ resolving dependencies…
added 42 packages in 3.1s
vlt registry
$vltinstallnext
resolving dependencies ✓ >extracting files ✓
23 cache hits
75 requests
Done in 1.1s
$
How much could you save?
Estimate your monthly CI savings. Adjust your install volume to see how vlt compares to npm on GitHub Actions 4-core runners.
How does vlt compare?
Savings breakdown
Stop unsafe packages
before they reach your builds
Every request for a public package passes through a security layer that blocks known malware and high risk software. Using vlt’s client reduces install-time risk further with safer package-manager defaults and configurable policies at the point of consumption.
Registry protection
$vltimalware
resolving dependencies ✗
Error: [404] - Package not found in registry
$
Malicious packages get blocked automatically, backed by continuous advisory and malware scanning across a safe npm mirror.
Safer installation
$vltinext
resolving dependencies ✓ > extracting files ✓
📦 1 packages have install scripts
🔎 Run `vlt query :scripts` to list them
🔨 Run `vlt build` to run all required scripts
$
Lifecycle scripts are restricted or disabled by default, risky behaviors require explicit approval, and hardening is secure-by-default rather than opt-in.
Organizational policy
$vltquery:scripts
project
└─┬ next@16.2.11
└── sharp@0.34.5
$
Query the dependency graph with DSL, then turn those queries into enforceable CI rules that block dependencies based on package properties, relationships, or security metadata.
Understand
every dependency
Explore your project’s fully resolved dependency graph (no theoretical SBOMs here). Trace why a dependency exists, inspect how specifications resolve, identify affected transitive packages, and query the graph with a powerful selector syntax designed specifically for JavaScript dependencies.
$vltsetupacme --config=project
Logged in successfully
Registries configured: npm, main
$vltinstall
$
Explore
Browse private packages and upstream mirrored npm packages
Setup instructions$vltquery[name^=cookie]
project
└─┬ express@5.2.1
├── cookie@0.7.2
└── cookie-signature@1.2.2
$
Trace
See why and how dependencies were resolved
Learn more$vltquery:fs
project
├─┬ express@5.2.1
│ ├── etag@1.8.1
│ ├─┬ send@1.2.1
│ │ └── etag@1.8.1
│ └─┬ serve-static@2.2.1
│ └── send@1.2.1
$
Query
Identify packages using Dependency Selector Syntax
Query documentation✓ :malware - 0 results
✓ :vulnerable - 0 results
✓ *:license(copyleft) - 0 results
✓ :deprecated - 0 results
✗ :root > * - 28 results
Failed: 1 of 5 queries did not
meet expectations
$
Control
Convert those queries into policies and graph transformations
PoliciesPrivate registries
built for JavaScript teams
Publish scoped and private packages, manage organizations and access, and give every developer and CI environment a consistent source for their public and private software.
Invite team members
Create an account, and invite members to your organization to start collaborating
Join many organizations
Join multiple organization with a single account, and collaborate across many teams
Explore trusted packages
Explore and install trusted packages from the secure npm mirror
Publish private packages
Publish packages with to your organization’s registry and start installing trusted packages
Latest News
vlt 1.0 & Hosted Package Registries
Stable client release and general availability of hosted JavaScript registries & ecosystem mirrors.
Darcy Clarke CEO
Typosquatting was a spellcheck issue. Slopsquatting is a trust issue.
Consuming JavaScript packages safely just got more complicated.
Jen Chan
Ship JavaScript? Hang onto your lockfile
Pinning dependencies in package.json won't save you in a supply-chain attack — a committed lockfile does. Here's why, and how to install so it holds.
Jen Chan