alt.hn

8/4/2026 at 5:43:55 PM

Vlt 1.0 and Hosted Package Registries

https://www.vlt.io/blog/1-0

by patrikcsak

8/4/2026 at 6:51:36 PM

I am not sure exactly what this service is or why it is desirable. Pitch me in five seconds or less?

by thataccount

8/4/2026 at 7:36:55 PM

5s: save time & money

10s: vlt helps engineering teams build JavaScript software faster, reduce supply chain risk, and lower infrastructure costs (via. API perf / payload optimizations).

20s: If you've used npm for years & are just narrowly escaping the various malware attacks or are on the hook for running up CI/agent bills at work because cold installs are X percent of the time compared to your actual builds/runtime, then you should check us out.

22s: Also, <insert jFrog grumble>.

by clarke78

8/4/2026 at 9:41:15 PM

Yeah but what is it?

by skrebbel

8/4/2026 at 8:47:47 PM

To add a bit of non-Vlt (I work on the JS Platform Team at Netflix where I have driven many of our decisions in the package manager space the past 6 years) but highly involved and supportive community member:

The team that was able to ship the most important features for npm to be competitive in the modern JS stack from ~2020 was able to take a fresh look at the problem without the organizational baggage of Github/Microsoft.

On the technical side, the ecosystem is maturing and we need a better set of foundational tools to meet that maturity level. This includes deep commitment to performance, security, and DX. The full product is more than just a package manager, it is a registry, a registry client, a task runner, and much more. Vlt is aiming to be this mature foundation.

Feel free to correct me if I am wrong on anything here Darcy.

P.S. grumble grumble...jFrog is a trash fire....grumble grumble

by wesleytodd

8/4/2026 at 8:51:49 PM

...can you make the 5s pitch be more like 'X times faster than pnpm and more secure' but fill X for me? unless it isn't pnpm at all in which case replace with 'it does X' because I've no idea after reading your post and a quick skim of the announcement itself?

by baq

8/4/2026 at 9:19:52 PM

Perf is highly nuanced but we've been doing realistic benchmarking for the ecosystem for almost a year now: https://benchmarks.vlt.sh/

We've got more improvements coming soon but we're a roughly ~10-40% faster registry then npm out-of-the-box. Compared to incumbent enterprise registries we're like ~3x.

by clarke78

8/4/2026 at 9:29:42 PM

jFrog is horrendous, so can you also tackle Python please?

by xixixao

8/4/2026 at 7:38:46 PM

This will benefit the entire ecosystem. Well done.

by viviansolide

8/4/2026 at 9:21:58 PM

Appreciate the kind words! We're excited to keep supporting this ecosystem.

by clarke78

8/4/2026 at 6:37:06 PM

Over a year I joined the waitlist and almost forgot that I did. Today the registry is open to deliver on its promises—secure the supply chain.

by nerdalytics

8/4/2026 at 6:42:05 PM

Founder here - thanks for the vote of confidence! We've got a lot more in store.

by clarke78

8/4/2026 at 6:50:46 PM

Without identity federation via oidc it’s basically not really a replacement for verdaccio

by merb

8/4/2026 at 7:29:27 PM

This is coming imminently but appreciate the feedback & will push to get this landed here quickly. That said, our client does support OIDC publishing if your registry does so hopefully you'll still find value there as it's a major step up from legacy npm clients.

by clarke78

8/4/2026 at 8:00:21 PM

So this is advertising as a secure npm?

by joeyagreco

8/4/2026 at 8:52:10 PM

[dead]

by jeffbcross