vlt
vlt.io
What it is
vlt provides npm-compatible JavaScript package registries for teams publishing scoped or private packages and managing organizations and access. It is available as a web service or self-hosted, with a client compatible with vlt, npm, pnpm, yarn, bun, deno and CI publishing. Registry infrastructure uses caching and smaller payloads. Developers can inspect resolved dependency graphs, trace why dependencies exist and query them with selector syntax; the CLI handles installation, publishing, configuration, execution and dependency queries. The registry says it blocks known malware and high-risk software through advisory and malware scanning across a safe npm mirror. Lifecycle scripts are restricted or disabled by default, and risky behavior needs explicit approval. Socket integration identifies dependency security risks. The VSR private registry can run locally or in CI with granular access tokens. TLS 1.2 or later and MFA for high-risk systems are stated security controls. Free costs nothing with 2GB storage and delivery, upstream proxy, user and token management and community support. Pro costs $8 a month, billed annually; Premium costs $20 a month, billed annually; Enterprise costs $79 a month, billed annually. Enterprise+ pricing is custom.
Spec sheet
- Product
- vlt provides npm-compatible JavaScript package registries for teams to publish scoped and private packages and manage organizations and access.Read 30 Sep 2026 · vlt.io
- Audience
- The pricing page describes Free as for developers trying vlt for the first time, Pro for developers needing extra bandwidth, Premium for growing teams, and Enterprise for large organizations with advanced needs.Read 30 Sep 2026 · vlt.io
- Integrations
- The documentation says packages can be published using vlt, npm, pnpm, yarn, bun, deno, or from CI.Read 30 Sep 2026 · docs.vlt.io
- Compliance
- The pricing page lists a SOC 2 Type II report with the Enterprise plan; it lists SSO/SAML and activity logs as coming soon.Read 30 Sep 2026 · vlt.io
- Support
- The Free plan includes community support, Pro includes chat and email support, and Enterprise includes a dedicated support channel.Read 30 Sep 2026 · vlt.io
- CLI
- The vlt client includes commands for package installation, publishing, configuration, execution, and dependency queries.Read 30 Sep 2026 · vlt.io
- Dependency graph
- vlt lets users explore resolved dependency graphs, trace why dependencies exist, and query them with selector syntax.Read 30 Sep 2026 · vlt.io
- Dependency security integration
- The documentation describes security-risk identification through vlt's integration with Socket.Read 30 Sep 2026 · docs.vlt.io
- Install security
- Lifecycle scripts are restricted or disabled by default, and risky behavior requires explicit approval.Read 30 Sep 2026 · vlt.io
- Package delivery
- The registry uses JavaScript-focused infrastructure with caching and smaller payloads while remaining compatible with existing team tools.Read 30 Sep 2026 · vlt.io
- Private registry option
- The VSR project describes an npm-compatible private registry that can run locally or in CI and supports granular access tokens.Read 30 Sep 2026 · vlt.io
- Registry protection
- The registry says it blocks known malware and high-risk software, backed by continuous advisory and malware scanning across a safe npm mirror.Read 30 Sep 2026 · vlt.io
- Security controls
- vlt's security policy states that traffic is encrypted with TLS 1.2 or later and MFA is required for high-risk systems.Read 30 Sep 2026 · vlt.io
Plans and prices
Free Free 2GB Storage+Delivery · Upstream Proxy · User Management · Token Management · Community Support Read 30 Sep 2026 · vlt.io
Pro $8 a month Billed annually 10GB Storage+Delivery · Additional Usage Billed Per GB · Chat and email support Read 30 Sep 2026 · vlt.io
Premium $20 a month Billed annually · Min 2 seats 50GB Storage+Delivery · Additional Usage Billed Per GB Read 30 Sep 2026 · vlt.io
Enterprise $79 a month Billed annually · Min 10 seats 1TB Storage+Delivery · SOC 2 Type II Report · Dedicated Support Channel · SSO / SAML (coming soon) · Activity Logs (coming soon) Read 30 Sep 2026 · vlt.io
Enterprise+ Priced on request Custom solutions Read 30 Sep 2026 · vlt.io
Strong points and limits
Strong points
- npm-compatible private and scoped registries
- Web and self-hosted deployment
- Dependency graph queries and tracing
- Lifecycle scripts restricted by default
- Free plan with 2GB storage and delivery
Limits
- Premium requires at least two seats
- Enterprise requires at least 10 seats
- SSO/SAML is coming soon
- Activity logs are coming soon
Who it suits
vlt suits JavaScript developers and teams managing private or scoped packages, dependency graphs and registry access. Its plans address individual experimentation through large organizations.
Verdict
vlt combines package publishing, dependency inspection and registry security controls across hosted and self-hosted options. Review storage, seat minimums and upcoming features when selecting a plan.
Where Specifiction places it
- JavaScript Package Managers#13 of 197.5
