{
  "id": 6108467,
  "title": "vlt 1.0 Ships as a Drop-in npm Replacement with Phased Installs, Graph Queries, and Malware-Blocking",
  "url": "https://urgent.news/2026/09/07/vlt-1-0-ships-as-a-drop-in-npm-replacement-with-phased-installs-graph",
  "topic": "tech",
  "section": "Tech",
  "published": "2026-09-07T06:31:00.000Z",
  "source": {
    "name": "InfoQ",
    "slug": "infoq",
    "url": "https://www.infoq.com/news/2026/09/vlt-npm-replacement/"
  },
  "original_language": "en",
  "account": "The JavaScript package manager and registry, vlt, has released version 1.0 as a drop-in replacement for npm. The new version introduces several key features, such as phased installations, a queryable dependency graph with more than 60 CSS-like selectors, and hosted registries that block known-malicious packages before they are served.\n\nThe approach differs from npm, where a package is downloaded, extracted, and runs lifecycle scripts all at once. vlt separates this process, allowing users to download and extract packages with vlt install, then run scripts only for the packages they trust with vlt build. This mechanism defaults to checking for malware, thereby rejecting any flagged packages.\n\nvlt's query capability allows users to treat the dependency graph like a DOM tree, offering a more efficient way to audit dependencies at scale. Among the 60+ selectors available, around half are security-focused and powered by a Socket integration. Additionally, the --view=mermaid flag can render matched dependencies as a diagram.\n\nWhile the service has received mixed reactions, some users appreciate it as beneficial for the entire JavaScript ecosystem. Developer Darcy Clarke of vlt emphasizes the benefits of saving time and money, reducing supply chain risk, and lowering infrastructure costs. The announcement comes amid a surge in supply chain attacks, with npm v12 disabling install scripts by default, pnpm quarantining fresh releases, and Bun blocking postinstall scripts.\n\nvlt has flagged over 275,000 malicious package versions, though many remain installable on npm. The migration from npm to vlt is relatively straightforward, requiring npm install -g vlt and running vlt install and vlt build. The npm-compatible registry API ensures existing CI pipelines, private registries, and tooling remain functional.",
  "summary": "vlt, created by the original npm team, has launched version 1.0 as a drop-in replacement for npm. It features phased installations to prevent automatic script execution, a queryable dependency graph with over 60 selectors, and hosted registries that block malicious packages. The tool aims to enhance security and streamline the JavaScript development process. By Daniel Curtis",
  "key_points": [],
  "editors_take": null,
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}