@vltpkg

JavaScript package registries & tooling for teams that move fast.

vlt.io
Joined March 2023
  • Tweets272
  • Following257
  • Followers1.5K
16Media
Agent Skills are also dependencies
Ruy Adorno@ruyadornoOct 20
🚀 Just shipped a new `vlt skills` cmd as part of v1.5.0 of the vlt CLI so that we can properly manage these skills that are already being shipped in packages.
1
2
107
vlt /vōlt/ retweeted
Socket
@SocketSecurityOct 21
.@vltpkg 1.5.0 links agent skills from your dependencies to coding agents, with versions pinned by your lockfile. The default skills filter uses Socket data to exclude packages flagged as malware before their instructions reach your agents. socket.dev/blog/vlt-skills

vlt 1.5.0 Adds Agent Skills Management

vlt 1.5.0 links skills from JavaScript dependencies to coding agents, with lockfile versioning and Socket data to filter out known malicious packages.

socket.dev
2
7
18
2,367
Github: the poison is free, but you can pay for the antidote github.blog/changelog/2026-1…

GitHub package firewall in public preview - GitHub Changelog

Editor’s note (October 21, 2026): Rewrote the changelog for clarity and added imagery. There’s been a recent flood of malware attacks that exploit systems at package installation time. Agents and…

github.blog
3
2
7
449
vlt /vōlt/ retweeted
Ruy Adorno@ruyadornoOct 20
🚀 Just shipped a new `vlt skills` cmd as part of v1.5.0 of the vlt CLI so that we can properly manage these skills that are already being shipped in packages.
2
3
1
7
402
vlt /vōlt/ retweeted
Ruy Adorno@ruyadornoOct 15
🚀 [email protected] is out with faster installs for macos and a new `--save-types` option to automatically add type dependencies.
1
2
5
279
I thought I'd share some of my thoughts/feelings about the recent Deno acquisition... tl;dr competition is a very good thing & we're all better off because people take risks to innovate & disrupt the status quo. [link below]
1
1
7
858
vlt.io/blog/competition-keep…

Thank you, Deno | vlt /vōlt/

Deno is joining Cloudflare & winding down its investment in the runtime. We're all better off because of its existence.

vlt.io
2
299
The #vlt client now has an 'outdated' command! Read all about it: vlt.io/blog/vlt-outdated What do you want from an 'outdated' command?

vlt outdated | vlt /vōlt/

We shipped the "vlt outdated" command. Find out what packages need upgrading and if you're vulnerable.

vlt.io
1
3
328
vlt /vōlt/ retweeted
luke@lukekarrysOct 6
on the ⚡️@vltpkg ⚡️registry we serve metadata that is 70% smaller which is one reason (out of many!) that we're able to do clean installs in 20-70% less time when you point to our registry vs npmjs․org. i wrote about how we did it: vlt.io/blog/registry-metadat…

How we made registry metadata 70% smaller | vlt /vōlt/

Package managers download megabytes of package metadata on every clean install. Here is how vlt.io serves the same installs at a fraction of the size.

vlt.io
1
4
1
9
367
Your private JavaScript registry can now publish to the public. Public packages are now GA. Publish and install the packages you want to share with the ecosystem. Read the full announcement here ↓ vlt.io/blog/public-packages

Public Packages | vlt /vōlt/

Explore the JavaScript ecosystem without an account, and publish packages from your own registry for anyone to install.

vlt.io
1
1
1
6
697
vlt /vōlt/ retweeted
cody
@codybrouwersSep 22
Some more data for CI cold installs after switching to vlt's registry from npm. 35% faster at p90!
cody
@codybrouwersSep 10
Switched to @vltpkg registry from npm and saw some nice improvements in cold installs and package metadata size
4
5
3
9
3,145
vlt /vōlt/ retweeted
NodeConf EU@NodeConfEUSep 2
🚀 Thrilled to announce @vltpkg as a #Silver #Sponsor of #NodeConfEU 2026! Thank you! 💛 Your partnership is helping us create something truly special in the #Node.js #community! 🎟️ nodeconf.eu
1
2
1
5
492
vlt /vōlt/ retweeted
Darcy Clarke
@darcySep 10
vlx hunkdiff # <3 – at Toronto, Ontario
Ben Vinegar
@bentlegenSep 10
🏛️ announcing hunk v0.22.0 - now w/ `hunk log` - TUI for reviewing git/jj history - quickly jump from commit → diff - OR multi-select a commit range - supports mouse + all colour themes also in this release: multi-line comments, lower memory usage, faster --watch, & more! 🔈
1
1
10
1,703
vlt /vōlt/ retweeted
Darcy Clarke
@darcyAug 28
This can't be overstated. Funny enough, dual support outpaces esm-only (expected, as maintainers want the broadest interop). We're almost a decade in & esm-only pkgs are only growing at ~2% /yr; at that pace, it'd take another decade to hit ~50%. refs. github.com/wooorm/npm-esm-vs… – at Mississauga, Ontario
Bret Comnes@bcomnesAug 26
Hate to say it but ESM probably goes down as one the lowest ROI of any js feature. Im glad we have it but omg what a waste of time it has been.
2
2
2
14
10,336
10 versions of @7nohe/openapi-react-query-codegen was published to npm in an ongoing attack. They contained provenance. github.com/7nohe/openapi-rea…

Security: package is currently publishing malicious code · Issue #218 · 7nohe/openapi-react-query...

Between 2026-08-28 20:00 and 20:21 UTC, 8 versions of @7nohe/openapi-react-query-codegen were published to npm containing a remote-code-execution payload. This includes 3.0.4, the current latest ta...

github.com
411
vlt 1.0.5 is here 🚀 Faster installs when package.json declares duplicated depedencies: up to 40% smaller. Safer installation and package publishing by default: tar decompression caps & path-traversal hardening enforced. github.com/vltpkg/vltpkg/rel…
2
5
600
Thanks to @drawliin for 2 wonderful contributions 😊
1
2
119
You've all solved centering a div with agents. Now what about package management?
1
1
5
962
Crazyy...someone measured Claude's vocabulary across 47,464 GitHub pull requests. A word cluster that didn't exist in 2025 is now 45% of human-authored PRs. The top word is "load-bearing"
78
100
40
1,654
133,854
vlt /vōlt/ retweeted
Zerotic@_ZeroticAug 25
Replying to @LukeberryPi
You should be testing your UI
1
1
4
3,381
Load more