vlt 1.0: Switch From npm Before Your Next Incident

The team that built npm just shipped its replacement. vlt 1.0 — pronounced “volt” — went generally available on August 4, 2026, complete with hosted package registries. Isaac Schlueter, who created npm in 2009, and Ruy Adorno, a former npm core maintainer, built vlt to fix the thing they know npm got wrong: running untrusted code the moment you type npm install.

The Problem vlt Is Actually Solving

In 2025, attackers published 454,600 new malicious open source packages — a 75% year-over-year increase. More than 99% targeted npm specifically. The cumulative count of known-malicious packages now exceeds 1.23 million. A supply chain compromise costs an average of $4.91 million and takes 267 days to detect, according to Sonatype’s 2026 State of the Software Supply Chain report.

npm’s design is why this keeps happening. When you run npm install, every package in your dependency tree can execute lifecycle scripts — automatically, with your credentials, with access to your filesystem. The attacker doesn’t need to trick you into running anything. You already did it.

How vlt Changes the Equation

vlt breaks the install process into two explicit steps:

• vlt install — downloads and extracts packages. No scripts run. Nothing executes.
• vlt build — runs lifecycle scripts for packages you explicitly trust.

That single architectural decision eliminates the most common npm attack vector. A malicious package cannot exfiltrate your AWS credentials or propagate to other packages simply because you added a dependency. vlt has already flagged over 275,000 package versions as malicious. More than 25% of them are still available for download on npm right now.

The Query Syntax: Audit What npm Hides

npm gives you a flat list of installed packages. vlt gives you a queryable dependency graph with CSS-selector-like syntax and over 60 graph selectors — about 30 focused on security. No other package manager has anything like this.

# Check your entire dependency tree for known malware
vlt query ":malware"

# Find dependencies with known CVEs
vlt query ":cve"

# Find every package in your tree that uses eval()
vlt query ":eval"

# Find packages with filesystem access
vlt query ":fs"

You can also visualize the graph in Mermaid format with vlt query "[name=express] > *" --view=mermaid. The full list of security selectors in the vlt docs includes :unmaintained, :license, :vuln, :built, :hostname(), and :diff(). These are the queries your security team wants and currently has no good way to run at scale.

Hosted Registries: What’s New in 1.0

vlt’s serverless registry has been around since the initial announcement. The big addition in 1.0 is that hosted registries and ecosystem mirrors are now generally available:

• Malicious packages are blocked at indexing time — before they reach you
• vlt ingests OSV advisories and malware feeds continuously
• Private registry with team access controls
• All existing tools work: npm, pnpm, yarn, bun, and deno can install from vlt registries without changes

The traditional model — detect malware, notify users, unpublish eventually — is over. vlt’s registry rejects known-bad packages before they’re ever served.

Switching From npm Takes Four Commands

vlt is a drop-in replacement. The migration guide is short because the surface area is small:

# Install vlt globally
npm install -g vlt

# In your existing project
vlt install   # replaces: npm install
vlt build     # replaces: npm run prepare / postinstall

Config moves to vlt.json (replaces .npmrc). The lockfile becomes vlt-lock.json. The registry API is backwards-compatible, so your CI pipelines, private registries, and tooling keep working.

Should You Switch Now?

For greenfield projects, yes. For existing codebases, the migration is low-friction but requires a full reinstall on all developer machines and CI when the lockfile changes.

The compelling reason to switch isn’t speed — pnpm and bun still win on raw install benchmarks. It’s that vlt is the only package manager where running vlt install is not a security event. Given the trajectory of npm supply chain attacks — ByteIota covered the Keyv/Shai-Hulud attack hitting 2 billion installs earlier today — that’s a meaningful distinction.

The people who know npm’s architecture best decided it needed to be rebuilt. That’s worth paying attention to.