Stable client release and general availability of hosted JavaScript registries & ecosystem mirrors.

Consuming JavaScript packages safely just got more complicated.

Pinning dependencies in package.json won't save you in a supply-chain attack — a committed lockfile does. Here's why, and how to install so it holds.

As part of its planned 12th release, the npm CLI drops automatically running lifecycle scripts on installs as part of multiple planned breaking changes

Drizzle ORM recently hit a 100 MB limit in the npm registry and couldn't ship new releases for weeks. What is this limit?

We've doubled our open source pledge contribution to $14,000 ($3,500 per full-time engineer)

When you run vlt install, packages are downloaded and extracted to node_modules, but no lifecycle scripts execute.

Release subsets of your monorepo with the new version, pack, and publish commands using powerful selectors and a publish directory.

Compose queries visually in the GUI, without needing to know the dependency selector syntax.

Release subsets of your monorepo with the new version, pack, and publish commands using powerful selectors and a publish directory.

Run scripts across your dependency graph using powerful query selectors and the --scope config.

Managing dependencies in complex JavaScript projects just got easier. vlt now offers Graph Modifiers, a new way to take precise control of your dependency graph.

We are excited to share catalog support - a powerful new feature for centralized dependency management that reduces duplication and simplifies version orchestration across your projects.

Introducing `jsr:` Support

Introducing the New `vlt exec` Command

Unlock deep, actionable insights into your dependencies with vlts new security-first selectors — powered by metadata from Socket.

We launched a new tool to detect package integrity issues in the JavaScript ecosystem. Learn how `reproduce` is changing the game.

A look under the hood of a vlt install.

Recapping the HalfStack Phoenix conference.

Recapping the vlt team's week in Ireland.

Announcing our foundational Package Manager Client & Serverless Registry.

vlt joins Sentry, Astral, Val Town & more in contributing back to the open source ecosystem!

Luke Karrys joins vlt!

Join vlt in Toronto for Collision Conf 2024!

We put together an incredible team, with top-notch investors & a bold product vision.

An article detailing the massive bug at the heart of the npm ecosystem; encompassing a lack of validation by the public registry, package manifest inconsistancies & assumptions about package managers & security products