vlt 1.0 & Hosted Package Registries

Today, we're happy to announce vlt 1.0, and general availability of our hosted package registries and ecosystem mirrors. With these releases, vlt is now an end-to-end platform for developers, their teams and agents to ship faster, safer, and more reliably.

Our Package Manager

Since we first introduced vlt and vsr, the CLI has grown from a fast installer with a novel query syntax into a full-featured, security-first package manager now backed by our own infrastructure.

Here's some highlights:

• over 60+ graph native pseudo selectors including ~30 focused on security — examples include :malware, :cve, :unmaintained, :outdated, :eval, :fs, :license, :vuln, :peer, :diff(), :built, :registry(), :hostname(), :dist() and more.
• :host(local) allows for querying dependencies across every project on your machine at once, e.g. vlt query ':host(local) #react:v(<19)' to find which projects on your system that are on old react versions.
• the --scope flag makes run, exec, pkg, version, pack, publish, and more even more powerful by bringing selectors to all commands.
• Graph Modifiers — override any dependency in vlt.json using DSS selectors with CSS-like specificity resolution.
• Phased installations allow vlt install to download without running scripts; and vlt build to run selectively, blocking known malware by default.
• Catalogs help define dependency versions once in vlt.json, reference them everywhere with catalog:.
• OIDC "trusted publishing": publish from CI with no long-lived tokens into the npm public registry. Works out of the box on GitHub Actions; GitLab CI and CircleCI are supported when you supply their OIDC token.
• and a lot more...

Drop-in replacement for npm

The vlt client is a drop-in replacement for npm, and can run your entire package lifecycle through vlt, no npm fallback or dependency required.

# install the client
curl -fsSL https://install.vlt.sh | bash

# setup your configuration
vlt setup

# run your entire SDLC through vlt
vlt init ...
vlt create ...
vlt install ...
vlt build ...
vlt run ...
vlt exec ...
vlt query ...
vlt pack ...
vlt publish ...
vlt view ...
vlt update ...
vlt deprecate ...

# ... and much more

Our Hosted Registries & Mirrors

Backwards Compatibility

Our registry services are backwards compatible with the npm registry API, so you can use your existing tools and workflows with vlt. npm, pnpm, yarn, bun and deno are all supported and able to both install from and publish into our hosted registries.

# ex. safely install ecosystem dependencies through vlt
npm install express --registry=https://registry.vlt.sh/<account>/npm

Cost

We're committed to making vlt accessible to everyone. Historically, private registries have been expensive and complex to set up and maintain. With a generous free tier, you can get started today with just a few clicks.

You can learn more about our pricing tiers here.

Performance

The events of the past few years have made one thing clear, agents are the future of software development. As teams adopt AI-native development practices, the accelerated pace of shipping software requires better, dedicated infrastructure. Rapid development & ephemeral sandboxes are becoming the norm, making cold installation performance critical. At agentic scale the registry becomes the bottleneck.

Packages are served from edge infrastructure near your developers and CI, so installs stay quick wherever your team runs them. In our benchmarks, a clean install runs up to 38% faster than npm, no change to your tooling required.

Privacy

Consume or publish unlimited private packages scoped to your organization. Today, published packages are scope-enforced and manifest-validated, so nothing is published outside the namespace you own. Malformed or inconsistent manifests are rejected at the door.

Security

Compromised maintainer accounts, self-replicating worms, and increasingly more capable bad actors are exploiting the same gap: the public registry is slow to adapt. We've built our own infrastructure to address this, and treat blocking malware as a first class citizen.

We ingest public malware feeds and advisories databases from sources like OSV so known-bad packages are blocked as they're discovered by the ecosystem. Instead of waiting until after malicious payloads are delivered, we block malicious packages in the process of indexing them in our infrastructure and monitor over time; providing you with a new, safe origin by default. As of today, we've flagged over 275k package versions with over 25% of them still being actively available for download on npm public registry.

No need to wait weeks, days or hours when we're actively monitoring and blocking in minutes.

Register Your Account

Reserve your account name & start installing or publishing packages today!

Questions?

If you have questions about our hosted services you can book a sales demo or support call with our team here