tldr; if you used @vlt.sh as your package manager, then you were protected the minute @socket.dev flagged the malicious packages in the `axios` attack yesterday. The best time to switch your package manager was 48hrs ago, the next best time is right now. More below: blog.vlt.sh/blog/vlt-build

Yesterday we saw the most _new_ NPM packages being released in the last 12 months, at 2804 packages. Pretty steady upward trajectory here, unlike we've ever seen. This graph is spiky because it's daily data and weekends are lower.

The @vlt.sh benchmark suite has been updated to include the yarn v6 canaries (still a WIP & improving all the time): benchmarks.vlt.sh

🧑‍💻 Come "Cowork with Friends" tomorrow in Downtown Mesa! We'll be at Pair Cupworks from 8:30am-12pm. @vlt.sh will be sponsoring beverages and raffling off 1 free ticket to @halfstackconf.bsky.social Phoenix! Join the group or just show up! coworkwithfriends.com/group/downto...

Darcy Clarke and Ruy Adorno are longtime npm CLI maintainers and Node.js contributors. They join @joshuakgoldberg.com to discuss vlt, a new package manager and registry designed to improve performance, security, and developer experience. @darcyclarke.me @ruyadorno.com bit.ly/3YNGniF

@lukekarrys.com joins HalfStack Phoenix. A practical story about building for kids, using NFC cards to control music, and turning everyday interactions into something playful and intuitive. 📅 𝐉𝐚𝐧𝐮𝐚𝐫𝐲 𝟑𝟎𝐭𝐡, 𝟐𝟎𝟐𝟔 — 𝐌𝐚𝐣𝐞𝐬𝐭𝐢𝐜 𝐓𝐡𝐞𝐚𝐭𝐞𝐫, 𝐆𝐢𝐥𝐛𝐞𝐫𝐭 🎟️ halfstackconf.com/phoenix #HalfStackphoenix #TechEvents

Today, we published a security release for @nodejs.org that fixes a critical bug affecting virtually every production Node.js app. If you use React Server Components, Next.js, or ANY APM tool (Datadog, New Relic, OpenTelemetry), your app could be vulnerable to DoS attacks. 👇

The top licenses published on #npm . Number #2 is interesting because it's not really a well-known one, but it's the default choice when running `npm init`, so it likely represents all the people that just pressed enter without having an opinion. [1/2]

🚀 Here is @vlt.sh take on running lifecycle scripts on installs, adding another powerful capability to our query language syntax: blog.vlt.sh/blog/vlt-build #javascript #nodejs #packages

If you think npm's architecture is good, go watch @darcyclarke.me's talk. The dependency graph is complex and @vlt.sh is reinventing it in a smart and unique way. www.youtube.com/watch?v=o8nG...

Huge thanks to the @vlt.sh team for building something new and refreshing in the world of package managers and taunting me with LEGO to try it out. Join me and check them out: www.vlt.sh

Thanks @vlt.sh! This is awesome!

Seeing the recent supply-chain attacks made me prioritize this item from our backlog as I wanted a quick way to know if any of my local projects have been affected. Meet the new vlt client `:host()` Query selector: blog.vlt.sh/blog/host-co... #javascript #nodejs #packages

⚡ Point. Click. Discover. 🚀 We're excited to unveil a new Query Builder to @vlt.sh's UI. It's now dead simple to visually navigate complex dependency graph filters without typing a thing. No need to memorize our selector syntax (if you don't want to).

🚀 Dependency Selector Syntax can now be used across @vlt.sh commands like run, exec, and pkg! This enables precise filtering when running scripts, executing commands, or getting package info. You have access to the whole graph! Read more about how it works and some example use cases:

🚀 @vercel.com now supports vlt in builds with zero config: vercel.com/changelog/vl... @vlt.sh

🚀 Excited to announce another major addition to the @vlt.sh client: Graph Modifiers! Graph Modifiers enable fine-grain customization of your install using our powerful Dependency Selector Syntax ⚡️ Read more about it here: blog.vlt.sh/blog/introdu... #javascript #nodejs #packages

💬 @vlt.sh is starting Weekly Community Sync calls today (in ~5min actually); here's the deets: 📝 Agenda: github.com/vltpkg/vltpk... 🎙️ Join: recording.vlt.sh 🔴 Watch... On Riverside: recording.vlt.sh On YouTube: www.youtube.com/@vltpkg/live Excited to build together!

🚀 We just shipped catalog support to @vlt.sh! If you go grab the latest version you can now install & manage dependencies with pnpm-like catalog definitions (ex. `vlt i typescript@catalog:dev`). You can read more here: blog.vlt.sh/blog/catalog...

We're looking for a Senior Backend Engineer to join our team at @vlt.sh based here in Toronto 🇨🇦 at our HQ. If you love JavaScript & open source this may be right up your alley. Please share if you know anyone who would be a great fit. www.linkedin.com/posts/darcyc... #javascript #nodejs #packages

JSR now supports @vlt.sh 🎉

For the record the secret logo is @vlt.sh! Now I will never forget your logo! 😂

🙇‍♂️ Thank you @vlt.sh @ruyadorno.com et al. for giving the community a cohesive toolkit for working with packages docs.vlt.sh/packages. I wish I had some of these when I was building Paka with @schickling.dev ❤️!

In partnership with @socket.dev we're bringing Socket Package Alerts to your local dependencies when using the vlt client. Introducing Package Insight Selectors, a powerful addition to our Dependency Selector Syntax that helps you understand and secure your node_modules folder. #js #nodejs #vlt

vlt client: query package data for security information (provided by Socket) @ruyadorno.com @vlt.sh blog.vlt.sh/blog/insight... #ECMAScript #JavaScript

We're excited to announce the new Insights Selectors to the @vlt.sh's Dependency Selector Syntax. This new information allows you to query packages based on a variety of security-focused metadata powered by @socket.dev! ⚡️

🚀 We just launched `$ npx reproduce <pkg>`

whenever i try to use `--ours` vs `--theirs` in git:

🔥 Our new Design Engineer Jason Korol wrote up an awesome article on some recent ships related to the @vlt.sh GUI, including: 💾 Saved Queries 🏷️ Labelling 🔁 Interactive Dep Management 🖼️ Improved Metadata #gui #interactive #dashboard #query #interactive #dependencies

We were in Phoenix last week for @halfstackconf.bsky.social where @lukekarrys.com gave a talk titled "Performing Laparoscopic Lockfile Surgery" that showed examples for how `vlt gui` can be used to gain deeper insights into dependency graphs. Check out the recap here: blog.vlt.sh/blog/halfsta...

Wrote up my thoughts on @github.com npm and the JavaScript package registry startups @vlt.sh vsr & @deno.land JSR. There's a lot going on around JS/TS, Node.js package management and registries—and a whole lot of history. redmonk.com/kholterhoff/...

Tomorrow vlt is sponsoring the monthly Cowork with Friends event in Downtown Mesa and raffling off one free ticket to @halfstackconf.bsky.social! When: January 24, 9am - 12pm Where: Pair Cupworks, 31 S Robson #103, Mesa, AZ 85210 coworkwithfriends.com/group/downto...

vlt is thrilled to be sponsoring @halfstackconf.bsky.social Phoenix! I highly recommend attending this single-track, single-day conference on January 31st. Expect talks on a wide range of fun, creative topics. Use this link to get 10% off tickets: halfstackconf.com/phoenix

Catch @lukekarrys.com at HalfStack Phoenix as he presents ‘𝐏𝐞𝐫𝐟𝐨𝐫𝐦𝐢𝐧𝐠 𝐋𝐚𝐩𝐚𝐫𝐨𝐬𝐜𝐨𝐩𝐢𝐜 𝐋𝐨𝐜𝐤𝐟𝐢𝐥𝐞 𝐒𝐮𝐫𝐠𝐞𝐫𝐲.’ Discover a surgical approach to lockfile challenges with humor. halfstackconf.com/phoenix #HalfStack #Phoenix #DevTalk

visited js-montreal today and gave a quick presentation on all the stuff we just recently released at @vlt.sh 😊

We're now @vlt.sh here!

if your first version isn’t 0.0.0-0.1730830331789 you shipped too late

Great summary of our announcements this week at #NodeConfEU from our friends at @socket.dev

Introducing the vlt Package Manager & Serverless Registry ⚡️ Read more about our initial product offerings and their main features announced during #NodeConfEU: blog.vlt.sh/blog/introdu... #javascript #nodejs #package #vlt #vsr

We have just unveiled the first products the team have been hard at work for the past 6 months ⚡️ A new, free, open source JavaScript package manager that will serve as the foundation to our platform, along with our first product, the vlt Serverless Registry (vsr).

We’re live on vlt.sh ⚡️ Starting with a fresh new (and fast!) OSS package manager for you to try out, that includes an innovative UI that enables you to visually navigate your dependencies. Try it out now: `npm i -g vlt`

Excited to announce @vltpkg.bsky.social has signed The Open Source Pledge alongside @sentry.io & many more startups we love and admire. Open Source is the heart of our ecosystem & we must find ways to make it more sustainable. This is just the beginning. blog.vlt.sh/blog/making-... #OpenSource

oh I got one of these, which is pretty cool! 😎 Like I mentioned before, I'll be at nodeconf.eu with the rest of the vlt.sh team to talk about the work we've been doing for the past 6 months 🚀 Make sure to come say hi if you're there!

We're electrified to announce our team & investors! ⚡️ blog.vlt.sh/blog/the-team #javascript #startup #packages #opensource #team #venture