vlt
vlt is an npm-compatible registry and package management service for JavaScript teams.
What vlt is
vlt is an npm-compatible registry and package management service for JavaScript teams. It supports publishing scoped and private packages, managing organizations and access, and can be used on the web or self-hosted. Its CLI handles installation, publishing, configuration, command execution, and dependency queries. Developers can examine resolved dependency graphs, trace why dependencies are present, and query them using selector syntax. Package publishing works with vlt, npm, pnpm, yarn, bun, deno, or CI. The registry says it scans advisories and malware across a safe npm mirror and blocks known malware and high-risk software. Lifecycle scripts are restricted or disabled by default, with explicit approval required for risky behavior. The security policy specifies TLS 1.2 or later and MFA for high-risk systems. Free includes 2GB of storage and delivery. Pro costs $8 a month, billed annually; Premium is $20 a month, billed annually, with a two-seat minimum. Enterprise is $79 a month, billed annually, with a 10-seat minimum.
Good
- Works with common JavaScript package publishing tools
- Dependency graphs can be queried with selector syntax
- Lifecycle scripts are restricted or disabled by default
- Free plan includes 2GB of storage and delivery
Watch out
- Pro and Premium prices are billed annually
- Premium requires at least two seats
- Enterprise requires at least 10 seats
- SSO/SAML and activity logs are listed as coming soon
Who it suits
vlt suits JavaScript developers and teams publishing or managing npm-compatible packages. Its plans also address organizations with different storage, support, and access needs.
Verdict
vlt brings package publishing, dependency inspection, and registry security controls into one service. The free tier offers a starting point, while larger teams should check seat minimums and which enterprise features are not yet available.
Plans and prices
From vlt's own pricing page, checked 30 Sep 2026.
| Plan | Price | What it gives you |
|---|---|---|
| Free | Free | 2GB Storage+Delivery · Upstream Proxy · User Management · Token Management · Community Support |
| Pro | $8 a month | 10GB Storage+Delivery · Additional Usage Billed Per GB · Chat and email support · Billed annually |
| Premium | $20 a month | 50GB Storage+Delivery · Additional Usage Billed Per GB · Billed annually · Min 2 seats |
| Enterprise | $79 a month | 1TB Storage+Delivery · SOC 2 Type II Report · Dedicated Support Channel · SSO / SAML (coming soon) · Activity Logs (coming soon) · Billed annually · Min 10 seats |
| Enterprise+ | Priced on request | Custom solutions |
The facts
Each one read from vlt's own pages, with the date it was checked.
What it does
- Audience
- The pricing page describes Free as for developers trying vlt for the first time, Pro for developers needing extra bandwidth, Premium for growing teams, and Enterprise for large organizations with advanced needs.checked 30 Sep 2026
- CLI
- The vlt client includes commands for package installation, publishing, configuration, execution, and dependency queries.checked 30 Sep 2026
- Compliance
- The pricing page lists a SOC 2 Type II report with the Enterprise plan; it lists SSO/SAML and activity logs as coming soon.checked 30 Sep 2026
- Dependency graph
- vlt lets users explore resolved dependency graphs, trace why dependencies exist, and query them with selector syntax.checked 30 Sep 2026
- Dependency security integration
- The documentation describes security-risk identification through vlt's integration with Socket.checked 30 Sep 2026
- Install security
- Lifecycle scripts are restricted or disabled by default, and risky behavior requires explicit approval.checked 30 Sep 2026
- Integrations
- The documentation says packages can be published using vlt, npm, pnpm, yarn, bun, deno, or from CI.checked 30 Sep 2026
- Package delivery
- The registry uses JavaScript-focused infrastructure with caching and smaller payloads while remaining compatible with existing team tools.checked 30 Sep 2026
- Private registry option
- The VSR project describes an npm-compatible private registry that can run locally or in CI and supports granular access tokens.checked 30 Sep 2026
- Product
- vlt provides npm-compatible JavaScript package registries for teams to publish scoped and private packages and manage organizations and access.checked 30 Sep 2026
- Registry protection
- The registry says it blocks known malware and high-risk software, backed by continuous advisory and malware scanning across a safe npm mirror.checked 30 Sep 2026
- Security controls
- vlt's security policy states that traffic is encrypted with TLS 1.2 or later and MFA is required for high-risk systems.checked 30 Sep 2026
- Support
- The Free plan includes community support, Pro includes chat and email support, and Enterprise includes a dedicated support channel.checked 30 Sep 2026
