vlt
What it is
vlt is a package registry and management service for JavaScript teams. It supports publishing scoped and private npm-compatible packages, organizing teams, and controlling access. Teams can use it on the web or self-host it. Its client works with common package tools, and the registry uses caching and smaller payloads for package delivery. Developers can inspect resolved dependency graphs, find why dependencies are present, and query them with selector syntax. The command-line client covers installation, publishing, configuration, execution, and dependency queries. vlt says it scans advisories and malware across a safe npm mirror; lifecycle scripts are restricted or disabled by default, with risky behavior requiring explicit approval. It also describes identifying dependency risks through an integration with Socket. The Free plan is free and includes 2GB of storage and delivery. Pro is $8 a month, billed annually, and Premium is $20 a month, billed annually, with a two-seat minimum. Enterprise is $79 a month, billed annually, with a 10-seat minimum.
For and against
For
- Web and self-hosted deployment options.
- Works with npm, pnpm, yarn, bun, and more.
- Dependency graphs are searchable with selector syntax.
- Lifecycle scripts are restricted or disabled by default.
- Free plan includes 2GB storage and delivery.
Against
- Pro and higher listed plans are billed annually.
- Premium requires at least two seats.
- Enterprise requires at least 10 seats.
- SSO/SAML and activity logs are listed as coming soon.
The verdict
vlt combines npm-compatible package hosting with dependency inspection and registry controls. Its Free plan provides a way to start, while team size and the listed annual billing terms matter when choosing a paid tier.
Who it suits
It suits JavaScript developers and teams that need to publish and manage private packages, inspect dependencies, or control registry access. The listed plans range from individual experimentation to large organizations with advanced needs.
Plans and prices
Free
2GB Storage+Delivery · Upstream Proxy · User Management · Token Management
Read 30 Sep 2026 · vlt.io
Pro
10GB Storage+Delivery · Additional Usage Billed Per GB · Chat and email support
Read 30 Sep 2026 · vlt.io
Premium
50GB Storage+Delivery · Additional Usage Billed Per GB
Read 30 Sep 2026 · vlt.io
Enterprise
1TB Storage+Delivery · SOC 2 Type II Report · Dedicated Support Channel · SSO / SAML (coming soon)
Read 30 Sep 2026 · vlt.io
Enterprise+
Custom solutions
Read 30 Sep 2026 · vlt.io
On the record
- Audience
- The pricing page describes Free as for developers trying vlt for the first time, Pro for developers needing extra bandwidth, Premium for growing teams, and Enterprise for large organizations with advanced needs.vlt.io · read 30 Sep 2026
- CLI
- The vlt client includes commands for package installation, publishing, configuration, execution, and dependency queries.vlt.io · read 30 Sep 2026
- Compliance
- The pricing page lists a SOC 2 Type II report with the Enterprise plan; it lists SSO/SAML and activity logs as coming soon.vlt.io · read 30 Sep 2026
- Dependency graph
- vlt lets users explore resolved dependency graphs, trace why dependencies exist, and query them with selector syntax.vlt.io · read 30 Sep 2026
- Dependency security integration
- The documentation describes security-risk identification through vlt's integration with Socket.docs.vlt.io · read 30 Sep 2026
- Install security
- Lifecycle scripts are restricted or disabled by default, and risky behavior requires explicit approval.vlt.io · read 30 Sep 2026
- Integrations
- The documentation says packages can be published using vlt, npm, pnpm, yarn, bun, deno, or from CI.docs.vlt.io · read 30 Sep 2026
- Package delivery
- The registry uses JavaScript-focused infrastructure with caching and smaller payloads while remaining compatible with existing team tools.vlt.io · read 30 Sep 2026
- Private registry option
- The VSR project describes an npm-compatible private registry that can run locally or in CI and supports granular access tokens.vlt.io · read 30 Sep 2026
- Product
- vlt provides npm-compatible JavaScript package registries for teams to publish scoped and private packages and manage organizations and access.vlt.io · read 30 Sep 2026
- Registry protection
- The registry says it blocks known malware and high-risk software, backed by continuous advisory and malware scanning across a safe npm mirror.vlt.io · read 30 Sep 2026
- Security controls
- vlt's security policy states that traffic is encrypted with TLS 1.2 or later and MFA is required for high-risk systems.vlt.io · read 30 Sep 2026
- Support
- The Free plan includes community support, Pro includes chat and email support, and Enterprise includes a dedicated support channel.vlt.io · read 30 Sep 2026
