Since 1.0, vlt has shipped install-speed wins, security hardening, and quality-of-life CLI fixes.

Pinning dependencies in package.json won't save you in a supply-chain attack — a committed lockfile does. Here's why, and how to install so it holds.

Package registries for teams that move fast

Drizzle ORM recently hit a 100 MB limit in the npm registry and couldn't ship new releases for weeks. What is this limit?

Socket detected 84 compromised TanStack npm packages modified with suspected CI credential-stealing malware.

We've doubled our open source pledge contribution to $14,000 ($3,500 per full-time engineer)

Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.

The Axios compromise shows how time-dependent dependency resolution makes exposure harder to detect and contain.

When you run vlt install, packages are downloaded and extracted to node_modules, but no lifecycle scripts execute.

Bug Fixes sanitize NVM_AUTH_HEADER in wget path nvm_has_colors: also check if stdout is a terminal nvm_strip_path: avoid gawk-specific RT variable for mawk compatibility nvm_get_default_packages: ...

ALT: a man in a suit and tie is sitting at a desk with a computer and the word and written on it

Package management sits at the foundation of modern software development, quietly powering nearly every software project in the world. Tools like npm and Yarn have long been the core of the JavaScript...

ALT: a woman is standing in front of a sign that says news 4

ALT: a cartoon of a man standing in front of a stack of cardboard boxes and the words what the

When you run vlt install, packages are downloaded and extracted to node_modules, but no lifecycle scripts execute.

Packages downloaded from NPM can fetch dependancies from untrusted sites.