I'm proud and excited to be supporting @darcy, @izs, and @ruyadorno as they build @vltpkg.
Their goal is a worthy one: massively improve the packaging ecosystem for developers everywhere.
🚀🚀🚀
Feross
@feross
Press
Press coverage, podcast interviews, security research
and what developers are saying about vlt across the JavaScript ecosystem.
Command Palette
Search for a command to run...
Coverage
Podcasts, talks, and coverage about vlt and the JavaScript ecosystem
January 29Referenced
Securing npm is table stakes
Changelog Interviews #674
September 25Interview
Ex-npm Employee Making a New Package Manager: vlt
Syntax.fm #688
May 23~11k listens
Big Gulps, huh?
Changelog JSParty #324
July 07~17k listens
The massive bug at the heart of npm
Changelog JSParty #282
Interview
npm, vlt and the Future of JavaScript Package Management
DevTools.fm #127
~200 views
The Future of JavaScript Package Handling and Open Source
This Dot Media
November 15Conference Talk
Building a faster package manager
NodeConf EU
July 01
npm is unsafe*
Theo - t3.gg
March 30~77k views
The creator of npm is making something new
Theo - t3.gg
October 20~500 views
Next Gen Package Management
DX 2023
October 04Conference Talk
The Future of JavaScript Package Management
The Linux Foundation
Next-Gen JavaScript Package Management
Software Engineering DailyJan 2026Interview
Triple Threat: vlt, Vite 6, and Astro 5
Front-end Fire #72Dec 2024Podcast
Unlocking the Power of the Dependency Graph
Node Congress 2026Mar 2026Conference Talk
The Registry is Dead, Long Live the Registry!
JSConf 2025Oct 2025Conference Talk
Performing Laparoscopic Lockfile Surgery
HalfStack PhoenixJan 2025Conference Talk
News
Articles, blog posts, and industry analysis covering vlt
January 30
Is npm Enough?
RedMonk
January 15
vlt: A New JavaScript Package Manager by Former npm Engineers
InfoQ
November 18
vlt Debuts New JavaScript Package Manager and Serverless Registry
Socket
Announcing Bun and vlt Support in Socket
SocketNov 2025Platform Integration
vlt is now available in builds via zero configuration
VercelAug 2025Platform Integration
vlt Launches Real-Time Dependency Analysis Powered by Socket
SocketApr 2025Integration
vlt Launches "reproduce": A New Tool Challenging the Limits of Provenance
SocketFeb 2025Product Launch
Node v22.11.0 (LTS)、Nuxt 3.14、vlt Package Manager
JSer.infoNov 2024News
Our Seed Investment in vlt: The Future of JavaScript Packages
AccelMar 2024Investor Spotlight
Solving the Challenges of the JS Ecosystem
OpenJS FoundationFoundation Blog
vlt: The Future of JavaScript Package Management
DEV CommunityDeep Dive
vlt: A New Dawn for Package Management
HashnodeCommunity Post
vlt: The Next-Gen Package Manager by npm Veterans
MediumAnalysis
npm Author Launches New JavaScript Package Manager
JavaScript in Plain EnglishNews
JSR Open Governance Board
Deno BlogGovernance
A Paradigm Shift in JavaScript: Introducing vlt and VSR
SkynixAnalysis
Security
Coverage of security research by the security community
Patch Release GitLab 17.1.2 (CVE-2024-6595)
GitLabJul 2024CVE Patch
Manifest Confusion in npm Packages Identified by Novel Tool
SC WorldMar 2024Brief
800 npm Registry Packages at Risk of Manifest Confusion
SecureBlinkMar 2024News
Over 800 npm Packages Found with Discrepancies
The Hacker NewsMar 2024Investigation
npm Manifest Confusion Six Months Later
JFrogJan 2024Follow-Up
Manifest Confusion: A Major Bug in npm
InfoQJul 2023Analysis
npm Manifest Confusion: What Is It and Should You Worry?
SonatypeJul 2023Explainer
Manifest Confusion: Don't Believe What You See
CheckmarxJul 2023Research
Node.js Users Beware: Manifest Confusion Attack
The Hacker NewsJul 2023News
Addressing the npm Manifest Confusion Vulnerability
JFrogJul 2023Security Advisory
Manifest Confusion
Lutra SecurityJul 2023Advisory
npm's Manifest Confusion
FindSecJul 2023Advisory
npm Manifest Confusion: A Malware Hiding Weakness
Dark ReadingJun 2023Analysis
npm Ecosystem Vulnerable to Manifest Confusion Attack
CSO OnlineJun 2023News
Manifest Confusion: A New Threat to npm Trust
Infosecurity MagazineJun 2023News
Manifest Confusion
SocketJun 2023Original Research
npm Ecosystem at Risk from Manifest Confusion Attacks
BleepingComputerJun 2023News
JavaScript Registry npm Vulnerable to Manifest Confusion
The RegisterJun 2023News
CVE-2024-6595
CVECVE Record
Features
Featured in industry newsletters reaching thousands of JavaScript developers
ECMAScript News (June 2025)
ECMAScript NewsJun 2025Featured
ECMAScript News (March 2025)
ECMAScript NewsMar 2025Featured
JavaScript Weekly #713
JavaScript WeeklyNov 2024Featured
Node Weekly #557
Node WeeklyNov 2024Featured
Bytes.dev #371
Bytes.devNov 2024Featured
JavaScript Weekly #680
JavaScript WeeklyMar 2024Featured
Sentiment
What developers are saying
about vlt across social media
beyond stoked on what @darcy / @vltpkg team is cooking for the future of JavaScript packages
🫶✨🥺
Marc Laventure
@MarcLaventure
📦 At #NodeConfEU, @vltpkg debuted their new #JavaScript package manager and serverless registry, innovating in a space where npm has stagnated. Today on the Socket blog: Find out what the team has been creating for the past 6 months. 📩
Socket
@SocketSecurity
Can't wait for vlt to fix all our problems!!!! 🔥🔥🔥❤️❤️🙏🏾🙏🏾
Amal Hussein
@nomadtechie
Congrats @darcy @izs @ruyadorno and @lukekarrys on this launch!
'vlt gui' is SUPER COOL. Will come with more positive feedback when I kick the tires of the registry.
sMyle (🦋 @myles.dev)
@MylesBorins
How do you feel about npm? Not the client (npm vs. pnpm vs. yarn etc.), but the full product—package hosting, upload/download, team permissions, etc.?
I just had a call with @darcy about @vltpkg and honestly, I'm super stoked about it because it's what I hoped npm would become.
Tejas Kumar
@tejask
The JS ecosystem isn't known for its safety/security but this one is pretty wild. 👇
npm doesn't validate/compare a package's tarball and manifest.
You basically can't trust any info on npm relying on manifest metadata. 😥
Kudos to @darcy for uncovering!
Stefan Judis
@stefanjudis
Will npm be used mainly to install vlt like IE was used to install Chrome 🤔🙈
Jabran Rafique
@jabranr
Holy crap! Vlt — the new JavaScript package manager — just announced Isaac Schlueter is on the team.
Isaac is the creator of npm.
So now we have the guy who made Node working on JSR, and the guy who made npm working on vlt.
exciting times
Wes Bos
@wesbos
A new wave of innovation and investments in JS is coming.
Have you checked out @vltpkg yet?
Link in thread for the full interview.
Modern Web
@moderndotweb
I ❤️ @vltpkg's query syntax. I've found it helpful with "vlt view" (there's something similar with "npm query"). It's the better "list" option of package managers and is a pathway to actually get accurate results 🎉
jddalton.bsky.social
@jdalton
Exciting news for JavaScript developers!
Isaac Schlueter, the creator of npm, has brought back the original npm team to launch vlt. This new company is all about making JavaScript package management better.
vlt is introducing a new package manager and a serverless registry.
Amit Mirgal
@amit_mirgal
🙇♂️ Thank you @vlt.sh @ruyadorno.com et al. for giving the community a cohesive toolkit for working with packages. I wish I had some of these when I was building Paka ❤️!
Jason Kuhrt
@kuhrt.me