vlt 1.0 & Hosted Package Registries | vlt /vōlt/<br>svg]:pointer-events-none [&>svg]:size-3 text-foreground [a&]:hover:bg-accent [a&]:hover:text-accent-foreground group w-fit rounded-sm px-3" href="/blog/1-0">vlt 1.0 & Hosted Package Registries<br>svg]:px-2.5 rounded-sm" href="/sign-up">Sign Upsvg]:px-2.5 rounded-sm" href="/sign-in">Log In<br>Menu<br>svg]:px-2.5 rounded-sm text-muted-foreground" href="/blog">All Posts<br>svg]:pointer-events-none [&>svg]:size-3 text-foreground [a&]:hover:bg-accent [a&]:hover:text-accent-foreground bg-background rounded-sm capitalize">announcementsvg]:pointer-events-none [&>svg]:size-3 text-foreground [a&]:hover:bg-accent [a&]:hover:text-accent-foreground bg-background rounded-sm capitalize">registrysvg]:pointer-events-none [&>svg]:size-3 text-foreground [a&]:hover:bg-accent [a&]:hover:text-accent-foreground bg-background rounded-sm capitalize">client<br>vlt 1.0 & Hosted Package Registries<br>Stable client release and general availability of hosted registries & ecosystem mirrors.

Darcy ClarkeDarcy Clarke

August 04, 2026

Today, we're happy to announce vlt 1.0 , and general availability of our hosted package registries and ecosystem mirrors. With these releases, vlt is now an end-to-end platform for developers, their teams and agents to ship faster, safer, and more reliably.

Our Package Manager

Since we first introduced vlt and vsr, the CLI has grown from a fast installer with a novel query syntax into a full-featured, security-first package manager now backed by our own infrastructure.

Here's some highlights:

over 60+ graph native pseudo selectors including ~30 focused on security — examples include :malware, :cve, :unmaintained, :outdated, :eval, :fs, :license, :vuln, :peer, :diff(), :built, :registry(), :hostname(), :dist() and more.

:host(local) allows for querying dependencies across every project on your machine at once, e.g. vlt query ':host(local) #react:v( to find which projects on your system that are on old react versions.

the --scope flag makes run, exec, pkg, version, pack, publish, and more even more powerful by bringing selectors to all commands.

Graph Modifiers — override any dependency in vlt.json using DSS selectors with CSS-like specificity resolution.

Phased installations allow vlt install to download without running scripts; and vlt build to run selectively, blocking known malware by default.

Catalogs help define dependency versions once in vlt.json, reference them everywhere with catalog:.

OIDC "trusted publishing" : publish from CI with no long-lived tokens into the npm public registry. Works out of the box on GitHub Actions; GitLab CI and CircleCI are supported when you supply their OIDC token.

and a lot more...

Drop-in replacement for npm

The vlt client is a drop-in replacement for npm, and can run your entire package lifecycle through vlt, no npm fallback or dependency required.

bash

Copy<br># install the client<br>curl -fsSL https://install.vlt.sh | bash

# setup your configuration<br>vlt setup

# run your entire SDLC through vlt<br>vlt init ...<br>vlt create ...<br>vlt install ...<br>vlt build ...<br>vlt run ...<br>vlt exec ...<br>vlt query ...<br>vlt pack ...<br>vlt publish ...<br>vlt view ...<br>vlt update ...<br>vlt deprecate ...

# ... and much more

Our Hosted Registries & Mirrors

Backwards Compatibility

Our registry services are backwards compatible with the npm registry API, so you can use your existing tools and workflows with vlt. npm, pnpm, yarn, bun and deno are all supported and able to both install from and publish into our hosted registries.

bash

Copy<br># ex. safely install ecosystem dependencies through vlt<br>npm install express --registry=https://registry.vlt.sh//npm

Cost

We're committed to making vlt accessible to everyone . Historically, private registries have been expensive and complex to set up and maintain. With a generous free tier, you can get started today with just a few clicks.

You can learn more about our pricing tiers here.

Performance

The events of the past few years have made one thing clear, agents are the future of software development. As teams adopt AI-native development practices, the accelerated pace of shipping software requires better, dedicated infrastructure. Rapid development & ephemeral sandboxes are becoming the norm, making cold installation performance critical. At agentic scale the registry becomes the bottleneck.

Packages are served from edge infrastructure near your developers and CI, so<br>installs stay quick wherever your team runs them. In our<br>benchmarks, a clean install runs up to 38% faster<br>than npm , no change to your tooling required.

Privacy

Consume or publish unlimited private packages scoped to your organization. Today, published packages are scope-enforced and manifest-validated, so nothing is published outside the namespace you own. Malformed or inconsistent manifests are rejected at the door.

Security

Compromised maintainer accounts, self-replicating worms, and increasingly more capable bad actors are exploiting the same gap: the...