vlt ships 1.0 with hosted npm-compatible registries and installs that separate download from script execution

Sources: announcement, discussion
Summary: Darcy Clarke announced vlt 1.0 and general availability of the company's hosted JavaScript registries and ecosystem mirrors on 2026-08-04. The client is presented as a drop-in npm replacement with over 60 graph selectors, roughly 30 of them security-focused, including :malware, :cve, :vuln and :unmaintained. Phased installation lets vlt install download without running scripts and vlt build run them selectively, blocking known malware by default. The client supports OIDC trusted publishing to the public npm registry from GitHub Actions with no long-lived token, and the hosted registries are backwards compatible with the npm registry API, so npm, pnpm, yarn, bun and deno can install from and publish to them. The post claims a clean install up to 38% faster than npm in the company's own benchmarks and states vlt has flagged over 275,000 package versions with over 25% still downloadable from the public npm registry. Those are vendor figures that no third party has reproduced.
Why it matters: The phased install puts a step between fetching a tarball and executing its preinstall hook, which is where the Shai-Hulud seed packages ran.