Why vlt?

Most registries treat your packages as files to store. vlt treats them as a dependency graph to understand, and builds everything else on that.

That’s what makes vlt the package registry built for JavaScript: install the same npm packages in less time, block malicious dependencies before they reach your builds, publish privately, and query every relationship in your graph, all without changing the tools your team already uses.

A new package registry

JavaScript packages aren’t just files. They form dependency graphs that decide what runs on every install, build, and deployment, yet most registries were built to store files, not understand those relationships. When the registry understands the graph, speed, security, and observability become properties of the infrastructure, not features bolted onto a file store.

We’re doing this because we expect more from the systems we’ve always counted on to host and distribute our software.

The team behind vlt has built and maintained the tools the ecosystem runs on for years. vlt is where that experience goes next.

Move fast without changing your tools

vlt serves npm-compatible packages through infrastructure tuned for JavaScript metadata and install patterns, cutting download size, cache misses, and CI time.

• Real-project benchmarks. We measure against actual Next, Vue, and Svelte apps.
• Faster clean installs. vlt serves the same packages 3–6x faster than AWS CodeArtifact and 4–9x faster than GitHub Packages, and leads npm on typical framework apps (Astro 1.7x, Svelte 1.6x, Vue 1.25x). Numbers move daily; see the live benchmarks.
• Slimmer packuments. 76% smaller than the ten thousand most-downloaded npm packages, bloat big enough to have blocked a library’s releases for a month.

Stop unsafe packages before they reach your builds

Every public package request passes through a security layer that flags known malware and vulnerabilities before the package is served.

• Registry protection. Known-malicious packages blocked before delivery, on a safe npm mirror backed by continuous malware intelligence.
• Safer installs. A two-phase install (download, then opt-in build) restricts lifecycle scripts by default. Secure defaults, not opt-in hardening.
• Verifiable integrity. Content-addressable storage reverifies each package on every fetch.

It matters more every release: despite 63% download growth, Sonatype’s 2026 supply-chain report counted 838,778 packages published with a CVSS 9.0+ score.¹

Reproducibility, not just provenance

vlt/reproduce downloads, rebuilds, and compares packages against their exact source commits to confirm an artifact matches its source. Not security theatre, but verifiable outcomes.

Understand every dependency

Query your fully resolved dependency graph with selectors built for JavaScript:

• Explore. Browse package and ecosystem relationships.
• Trace. See why and how a dependency resolved.
• Query. Match packages with Dependency Selector Syntax (DSS), including security insights from Socket.
• Control. Turn queries into enforceable CI rules and graph transformations.

Built in the open

vlt’s stack is open source, built by a team that has maintained ecosystem projects for years: the vlt CLI and its packages, vsr (a serverless npm-compatible registry), and reproduce.

The private registry built for JavaScript teams

Publish scoped and private packages, manage organizations and access, and give every developer and CI environment one consistent source for public and private dependencies.

vlt is a strong fit if you publish packages others depend on, serve dependencies at scale, need risky scripts contained by default, or want every dependency accounted for from local installs through CI.

See how it holds up on your own dependencies. Start publishing.

Footnotes

1. In 2025, attackers published ~455,000 malicious npm packages. In September 2025, phishing and wallet-hijacking campaigns targeted maintainers of packages with 2.6 billion daily downloads, and self-propagating worms compromised 500-800 packages across two waves, breaching 25,000+ repositories and exposing 40,000+ credentials across AWS, Azure, and GCP. ↩