Since 1.0, vlt has shipped install-speed wins, security hardening, and quality-of-life CLI fixes.

Stable client release and general availability of hosted registries & ecosystem mirrors.

Pinning dependencies in package.json won't save you in a supply-chain attack — a committed lockfile does. Here's why, and how to install so it holds.

Package registries for teams that move fast

Drizzle ORM recently hit a 100 MB limit in the npm registry and couldn't ship new releases for weeks. What is this limit?

As a Developer Relations Engineer, you will serve as the bridge between vlt and the global JavaScript community. This role combines technical expertise, community engagement, and developer-focused mar...

Socket detected 84 compromised TanStack npm packages modified with suspected CI credential-stealing malware.

ALT: a close up of a man 's face with the words more on the bottom right

We've doubled our open source pledge contribution to $14,000 ($3,500 per full-time engineer)

Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.

The Axios compromise shows how time-dependent dependency resolution makes exposure harder to detect and contain.