Security at the
registry layer
Every public package request passes through a security layer that blocks known malware and high risk software, with safer package-manager defaults and configurable policies at the point of consumption.
Stop unsafe packages
before they reach your builds
Every request for a public package passes through a security layer that blocks known malware and high risk software. Using vlt’s client reduces install-time risk further with safer package-manager defaults and configurable policies at the point of consumption.
Registry protection
$vltimalware
resolving dependencies ✗
Error: [404] - Package not found in registry
$
Malicious packages get blocked automatically, backed by continuous advisory and malware scanning across a safe npm mirror.
Safer installation
$vltinext
resolving dependencies ✓ > extracting files ✓
📦 1 packages have install scripts
🔎 Run `vlt query :scripts` to list them
🔨 Run `vlt build` to run all required scripts
$
Lifecycle scripts are restricted or disabled by default, risky behaviors require explicit approval, and hardening is secure-by-default rather than opt-in.
Organizational policy
$vltquery:scripts
project
└─┬ next@16.2.11
└── sharp@0.34.5
$
Query the dependency graph with DSL, then turn those queries into enforceable CI rules that block dependencies based on package properties, relationships, or security metadata.