@vlt.io
JavaScript registries and tooling for teams that move fast.
@evertpot.comReposted by @vlt.ioFun fact about the NPM replication feed. If you just follow the feed to get updates for ever package, you will miss packages because they retroactively insert changes in the *past* of the feed.
@lukekarrys.comReposted by @vlt.io
@ruyadorno.comReposted by @vlt.ioThanks @vlt.io for contributing! 🔈 audio on to hear it from @nodeland.dev
@vlt.ioYour private JavaScript registry can now publish to the public.
Public packages are now GA. Publish and install the packages you want to share with the ecosystem.
Read the full announcement here ↓ www.vlt.io/blog/public-...
@vlt.io10 versions of @7nohe/openapi-react-query-codegen was published to npm in an ongoing attack.
They contained provenance.
@vlt.ioTrick question!
@evertpot.comReposted by @vlt.ioAre you talking about paths in a tar escaping the base path? A good package manager should prevent this. I know both npm and vlt do.
@vlt.io🤔 Imma bat this to @evertpot.com @ruyadorno.com who might know more
@vlt.ioMaintainers shouldn't carry the security & hosting burden alone.
We offer free package hosting for qualified open-source maintainers—high-reliability infrastructure & registry-level security so you can focus on building.
Apply here: www.vlt.io/open-source/...
@vlt.ioDeep dependency trees & unmaintained packages create constant operational tax for dev teams. Upgrading nested packages shouldn't mean risking broken lockfiles or malicious lifecycle hooks. When 98% of app stacks run on open source, maintainer infrastructure becomes critical.
@vlt.ioThe 2026 Black Duck OSSRA report dropped some wild data for JS/TS teams: • Open source powers 98% of commercial apps • 64%+ of JS dependencies are transitive (node_modules depth) • 93% of codebases rely on unmaintained "zombie" packages • Unsafe preinstall scripts remain a top vector 🧵
@vlt.ioThis weekend I read over the vlt team's dependency graph code and it blew my mind. Package management and install time safety is a very difficult problem space because all tools resolve dependencies differently.
@vlt.ioThat's a feat to behold - and to stick with - at work!
@vlt.ioWhat you're saying reminds me of the xkcd "15th standard" comic xkcd.com/927/
@vlt.ioHow do you prove whoever published your dependencies is who they say they are?
Did the maintainer publish this, or did someone compromise the registry?
With agents installing packages you can't read, that gap matters.
How do you verify package integrity?
@vlt.ioYour AI agent just installed 47 packages you didn't read. One might be malicious, but the registry will served it anyway.
When agents control dependencies, the trust chain breaks. Where does security live?
@vlt.io🧌
@vlt.ioLike 1Gigabit... 1 Gigabyte... or...?
@vlt.ioWhat if Semantic Versioning solved "is this compatible?" but not "is this safe?" SBOMs, provenance, lifecycle safety—all fragmented across ecosystems. Can we build *on* semver instead replacing it? Check out Darcy Clarke's talk, "Beyond Semver" at Node.js Interactive, Render ATL, Wed 2pm ET.
@vlt.ioSeems that's where the industry is moving!
