vlt ships 1.0 with hosted registries that work across npm tooling

Why it matters

Clarke is using npm compatibility to lower switching costs while moving vlt from open-source tooling into paid infrastructure. The bet is that heavier CI and coding-agent use will make registry speed and package screening worth paying for. ([vlt.io](https://www.vlt.io/blog/1-0?ref=runtimewire))

Darcy Clarke (@darcy), vlt's founder and CEO, launched the stable vlt 1.0 package manager and made the developer-tool maker's hosted JavaScript registries generally available in an August 4th announcement. The release gives vlt a complete commercial product: an npm replacement on the developer's machine, plus private registries and mirrors that can sit behind npm, pnpm, Yarn, Bun or Deno. (vlt.io)

Clarke has spent much of his career inside the tooling he is trying to rebuild. He previously managed GitHub's npm CLI and GitHub CLI engineering teams after GitHub acquired npm in 2020. When he introduced vlt's founding team in March 2024, Clarke described JavaScript packaging as essential infrastructure that had stagnated. (vlt.io)

He assembled a group with direct experience operating the incumbent stack. Isaac Z. Schlueter (@izs) created npm, ran npm Inc. and previously led Node.js. Ruy Adorno (@ruyadorno), who remains a staff software engineer at vlt, worked on the npm CLI at GitHub and later joined Google. The pitch rests on that history: the people who know where JavaScript packaging breaks are building both the client and the infrastructure behind it. (vlt.io)

A package manager built around dependency graphs

The 1.0 release moves the vlt client from a long release-candidate cycle into what vlt calls a stable, full-featured package manager. It handles the usual package lifecycle, including installation, script execution, updates, publishing and deprecation, without falling back to npm. (vlt.io)

Clarke and his engineers have built the client around dependency graphs rather than treating a project's package list as a flat manifest. Developers can query dependencies with more than 60 graph selectors, including roughly 30 selectors that vlt describes as security-focused. Those selectors can find packages connected to malware reports, CVEs, unmaintained dependencies, install scripts, licensing conditions or specific registries. A host-level selector can also search dependencies across every local project on a machine. (vlt.io)

That graph model also controls installation behavior. Phased installations separate downloading packages from running their lifecycle scripts. vlt install can populate node_modules without executing package-supplied code, while vlt build lets developers choose which scripts run afterward. vlt says known malware is blocked by default during that process. (vlt)

The separation addresses a recurring weakness in JavaScript package management: installation often gives third-party scripts access to a developer machine or CI runner before the developer has reviewed what will execute. vlt's approach makes script execution a distinct decision while preserving an option for teams that require conventional npm behavior. (vlt)

vlt 1.0 also supports dependency catalogs, graph-based overrides and OIDC trusted publishing. The latter allows CI systems to publish without storing long-lived registry tokens, with built-in support for GitHub Actions and configurable support for GitLab CI and CircleCI. (vlt.io)

The registry turns open-source tooling into a business

The hosted registry is the consequential part of the release for vlt. Clarke first presented the package manager and a serverless registry in a November 5th, 2024 launch. General availability gives vlt a paid service that can capture the package traffic generated by developers, CI systems and coding agents. (vlt.io)

Compatibility is central to the sales strategy. Teams can point existing npm, pnpm, Yarn, Bun or Deno clients at a vlt registry endpoint instead of replacing every package-management workflow at once. vlt can host organization-scoped private packages and mirror upstream public dependencies, while validating manifests before packages are published. (vlt.io)

The pricing page starts with a free plan that includes 2 GB of storage and delivery. Annual pricing is $8 per user each month for Pro, $20 for Premium and $79 for Enterprise, with larger storage allowances and support features at each tier. That model gives Clarke a direct path from free client adoption to recurring registry revenue. (vlt.io)

Clarke is tying the timing to AI-driven development, where agents create short-lived environments and repeatedly install dependencies. "At agentic scale the registry becomes the bottleneck," he wrote in the launch announcement. vlt says packages are served from edge infrastructure close to developers and CI, and claims its own clean-install benchmark ran up to 38% faster than npm. The figure comes from vlt's testing and has not been independently audited. (vlt.io)

The security argument is similarly aggressive. vlt says it consumes public malware feeds and advisory databases such as OSV, blocking known-bad packages while indexing them. As of August 4th, vlt claimed to have flagged more than 275,000 package versions, with over 25% of those versions still downloadable from npm's public registry. Those classifications and percentages are company-reported. (vlt.io)

Package screening remains an adversarial problem rather than a permanent shield. On January 26th, 2026, security firm Koi reported PackageGate vulnerabilities affecting vlt alongside npm, pnpm and Bun. The report said the flaws could potentially bypass package-manager security protections. The episode reinforces the value of a client and registry that can both change quickly, while showing why no package manager should be described as immune to supply-chain attacks. (Koi)

Rebuilding infrastructure the founders once operated

vlt announced its venture backing on March 20th, 2024. Accel led the financing, with Inovia Capital and Abstraction Capital participating. The backers also include Vercel CEO Guillermo Rauch, Socket CEO Feross Aboukhadijeh, Sentry CEO David Cramer and Vue.js creator Evan You. vlt has not published a round size or valuation. (vlt.io)

The 1.0 milestone begins the commercial test of Clarke's thesis. Compatibility lowers the cost of trying vlt because developers can keep familiar clients and change the registry endpoint first. Owning both layers gives vlt control over how dependencies are resolved, inspected, downloaded and executed.

That same scope raises the burden. Developers must trust vlt with credentials, private packages and a critical part of every build. Clarke's advantage is a founding group that has already designed and operated widely used JavaScript package infrastructure. With the stable client and hosted registries available together, vlt can now test whether that experience is enough to move package traffic onto infrastructure it controls.