JavaScript package registries & tooling for teams that move fast.
- Tweets 263
- Following 257
- Followers 1,483
- Likes 587
Your private JavaScript registry can now publish to the public.
Public packages are now GA. Publish and install the packages you want to share with the ecosystem. Read the full announcement here ↓ vlt.io/blog/public-packages
1
1
4
401
vlt /vōlt/ retweeted
Some more data for CI cold installs after switching to vlt's registry from npm.
35% faster at p90!
Switched to @vltpkg registry from npm and saw some nice improvements in cold installs and package metadata size
4
5
9
2,908
vlt /vōlt/ retweeted
🚀 Thrilled to announce @vltpkg as a #Silver #Sponsor of #NodeConfEU 2026!
Thank you! 💛
Your partnership is helping us create something truly special in the #Node.js #community!
🎟️ nodeconf.eu
1
2
5
473
vlt /vōlt/ retweeted
vlx hunkdiff # <3
🏛️ announcing hunk v0.22.0 - now w/ `hunk log`
- TUI for reviewing git/jj history
- quickly jump from commit → diff
- OR multi-select a commit range
- supports mouse + all colour themes
also in this release: multi-line comments, lower memory usage, faster --watch, & more! 🔈
1
1
10
1,676
vlt /vōlt/ retweeted
This can't be overstated. Funny enough, dual support outpaces esm-only (expected, as maintainers want the broadest interop). We're almost a decade in & esm-only pkgs are only growing at ~2% /yr; at that pace, it'd take another decade to hit ~50%.
refs. github.com/wooorm/npm-esm-vs…
Hate to say it but ESM probably goes down as one the lowest ROI of any js feature. Im glad we have it but omg what a waste of time it has been.
2
2
14
10,297
10 versions of @7nohe/openapi-react-query-codegen was published to npm in an ongoing attack.
They contained provenance.
github.com/7nohe/openapi-rea…
318
vlt 1.0.5 is here 🚀
Faster installs when package.json declares duplicated depedencies: up to 40% smaller.
Safer installation and package publishing by default: tar decompression caps & path-traversal hardening enforced. github.com/vltpkg/vltpkg/rel…
2
5
556
vlt /vōlt/ retweeted
Crazyy...someone measured Claude's vocabulary across 47,464 GitHub pull requests.
A word cluster that didn't exist in 2025 is now 45% of human-authored PRs.
The top word is "load-bearing"
79
100
1,660
133,630
vlt /vōlt/ retweeted
Works perfectly on page 1.
Page 1000 takes 30 seconds.
Page 10000 crashes the server.
Pagination is supposed to make it faster.
It's making it slower.
Why? 🤔
22
3
55
4,216
vlt /vōlt/ retweeted
"Everything you've ever installed and built runs through infrastructure me and my team built [over the years in npm]"
what a fucking banger.
vlt.io/
1
1
721
vlt /vōlt/ retweeted
Developers:
Why doesn’t JSON allow trailing commas?
It looks harmless.
But this is invalid JSON.
Why?
58
13
268
63,077
vlt /vōlt/ retweeted
Damn.. @vltpkg is great 👌 Bye NPM SHIT!
Simple setup:
- VLT proxy CF Worker with 2 service tokens
== read-only token for consumer reads
== read-write for convenience
- have a Github CI that publish to VLT with OIDC.
- have npm .wgw .lol as registry for ONLY MINE pkgs
Lovely.
"Everything you've ever installed and built runs through infrastructure me and my team built [over the years in npm]"
what a fucking banger.
vlt.io/
2
3
4
547
Linux users: watch out for these trojan npm packages masquerading as working calendar and streak utils
thehackernews.com/2026/08/14…
1
181
vlt /vōlt/ retweeted
have you found the smoking gun to make the output less load-bearing?
35
31
2,659
90,641
Cross-ecosystem package tracking is a nightmare when every tool formats dependencies differently. 🧵
Enter PURL (Package URL)—the open standard bringing sanity to software supply chains.
1
2
192
Add ?qualifiers for OS/arch details and #subpath for specific subfolders inside a package, and you have an unambiguous, deterministic identifier for any software artifact.
1
33