Darcy Clarke
@darcyclarke.me
@vlt.sh Founder & Chief End-User Officer Prev: GitHub, npm & Themify Co-Founder
Excited to share vlt 1.0 along with our hosted registries & ecosystem mirrors now GA! A drop-in npm replacement, built so nothing runs on your machine just because you typed install. → faster delivery → malware blocking at the registry layer → graph-native querying
⛰️ mountx :: mount JavaScript as a real filesystem! Write ~6 lines of JS, get a real directory any process can read & write: editors, CLIs, AI agents. Rootless on Linux (FUSE) and macOS (NFSv3 with no kernel extensions). ~Pure JS, zero deps. mountx.vercel.app
A familiar story: the build crashes, so you rm -rf node_modules && rm package-lock.json, then reinstall to get your dev env back. But once the lockfile's gone, your ^ ranges take over. npm install can grab the newest in-range version of everything: poison included when there's a supply chain attack
Ship JavaScript? Hang onto your lockfile | vlt /vōlt/
Pinning dependencies in package.json won't save you in a supply-chain attack — a committed lockfile does. Here's why, and how to install so it holds.
vlt.io
Love to see all the pieces coming together! Just ran a `vlt publish --scope=':workspace'` cmd that mass-publishes all my workspaces in a given project to a private registry in my vlt.io account ❤️
Home | vlt /vōlt/
Package registries for teams that move fast
vlt.io
There is CSS... but what if I told you there is such a thing as DSS? Dependency Selector Syntax is an expressive DSL written as a homage to CSS. Use it to inspect malicious dependencies in your repo docs.vlt.io/cli/selector...
If you regularly publish to the npm registry, you might be concerned about package size 😁 But have you heard of PACKUMENT size? News flash: how often you publish, how long your manifest is, how many *exports* you have, can also eventually prevent you from publishing!
Why Drizzle ORM couldn't publish new releases on NPM for a month | vlt /vōlt/
Drizzle ORM recently hit a 100 MB limit in the npm registry and couldn't ship new releases for weeks. What is this limit?
vlt.io
13 years ago today I made the first commit to the ESLint Git repo. It’s hard to believe that this project I cobbled together in my spare time over a couple of weeks is still going strong. I’ve been doing a lot of reflecting over these years and the journey it’s been. A thread.
⚡️ We're looking for a DevRel person at @vlt.sh - based in our Toronto 🇨🇦 HQ. You'll work closely w/ me & should love the idea of owning various aspects of product marketing. You'll be vlt's biggest fan & advocate; molding this unique role in a way that plays to your strengths & ours.
Today is a big day for @socket.dev. We raised a $60M Series C at a $1B valuation, led by Thrive Capital. 20,000+ orgs, 1.5M repos protected, 1,000+ supply chain attacks blocked per week. 3/5 FAANG companies are customers. We're just getting started.
today is a great day to rm -rf your work computer so you can take a little break
84 TanStack npm package artifacts were compromised in the ongoing Mini Shai-Hulud supply chain attack, adding suspected CI credential-stealing malware. Socket flagged every malicious version within six minutes of publication. Details: socket.dev/blog/tanstac...
Tanstack npm Packages Compromised in Ongoing Mini Shai-Hulud...
Socket detected 84 compromised TanStack npm packages modified with suspected CI credential-stealing malware.
socket.dev
The hidden gem is that @nodejs.org majors and LTS cycles got WAY easier to understand: 2026 -> v26 2027 -> v27 2028 -> v28 ... Aall of them go LTS for 18 months meaning each major is supported for 2 years. The new graphic tells the best story here: nodejs.org/en/blog/anno...
Rafael Gonzaga | Node.js@rafaelgss.dev · 3mo agoNode.js v26.0.0 is out 💚 Temporal API enabled by default, V8 14.6, Undici 8, and key deprecations as we keep modernizing the platform. Check it out nodejs.org/en/blog/rele...
While others race away from Open Source, @vlt.sh is doubling down. 🖤⚡ Today we’re announcing our renewed commitment to @opensourcepledge.com and investing back into the ecosystem. www.vlt.io/blog/doublin...
Doubling Down on Open Source | vlt /vōlt/
We've doubled our open source pledge contribution to $14,000 ($3,500 per full-time engineer)
vlt.io
📖 This article by @sarahgooding.bsky.social at @socket.dev highlights a concerning trend (ref. socket.dev/blog/attacke...) 📕 Story time: this kind of supply chain targeting isn't unique. I myself & everyone on our team @vlt.sh have been the targets of consistent, concerted efforts.
Attackers Are Hunting High-Impact Node.js Maintainers in a C...
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.
socket.dev
this is one of my favorite parts of the @vlt.sh CLI. it uses @socket.dev security data to prevent known malware from running lifecycle scripts like postinstall! and it’s powered by queries under the hood so you could make it as granular as you wanted (but we ship with safe defaults)
Darcy Clarke@darcyclarke.me · 4mo agotldr; if you used @vlt.sh as your package manager, then you were protected the minute @socket.dev flagged the malicious packages in the `axios` attack yesterday. The best time to switch your package manager was 48hrs ago, the next best time is right now. More below: blog.vlt.sh/blog/vlt-build
We’re seeing cases where teams can’t explain how they were compromised by the Axios incident because it doesn’t show up in their project's lockfile. The blast radius here is much larger than it looks. Deep dive into the messy reality of modern dependency resolution → socket.dev/blog/hidden-...
The Hidden Blast Radius of the Axios Compromise - Socket
The Axios compromise shows how time-dependent dependency resolution makes exposure harder to detect and contain.
socket.dev
I heard you like fast package managers? What about fast registries? It's been a roller coaster of a month but our team has made some serious headway w/ even more improvements in the works. Gotta keep the registry fast so y'all can nab the next Claude Code leak.
tldr; if you used @vlt.sh as your package manager, then you were protected the minute @socket.dev flagged the malicious packages in the `axios` attack yesterday. The best time to switch your package manager was 48hrs ago, the next best time is right now. More below: blog.vlt.sh/blog/vlt-build
Introducing Phased Package Installations
When you run vlt install, packages are downloaded and extracted to node_modules, but no lifecycle scripts execute.
blog.vlt.sh
Socket@socket.dev · 4mo ago🧨 Axios only needed to be resolved somewhere in your dependency graph to affect you. Semver + transitive deps + runtime installs = hidden blast radius. If you only checked your project’s lockfile, you may still not know. socket.dev/blog/hidden-... #nodejs #javascript
I'm still waiting on the "Vestro" announcement from @vercel.com today - where it's a slop fork of Astro...
Fixed up some perf issues and benchmark bugs in the new-streams reference impl ... some highlights running comparisons on @nodejs.org @deno.land and @bun.sh ... note each column is just looking at the one runtime, not comparing runtimes against each other ...
🚀 Coming in the next version of tsdown: built-in Node.js SEA (Single Executable Applications) support! Now you can bundle your JS apps into a standalone executable with a single command: tsdown --exe
Joyee Cheung@joyeecheung.bsky.social · 6mo agoLanded initial support for ESM in Node.js SEA: github.com/nodejs/node/... Similar to CJS entrypoints, it only supports importing builtins, so generally require bundling. @nodeland.dev is working on support for VFS in SEA that will unlock loading other modules within SEA github.com/nodejs/node/...
i built an entire x86 CPU emulator in CSS (no javascript) you can write programs in C, compile them to x86 machine code with GCC, and run them inside CSS lyra.horse/x86css/
What do people use to stay up to date with/monitor socials these days? My feed is 🔥 with AI tools & I feel like my meat brain & thumbs can't process the thousands of experiments/insights. Do I just spin up OpenClaw & make it monitor socials w/ daily recaps?
Doing some analytics with #NPM and this is the distribution of how many downloads NPM packages typically get.
The @vlt.sh benchmark suite has been updated to include the yarn v6 canaries (still a WIP & improving all the time): benchmarks.vlt.sh
I was recently on the Changelog podcast to talk about npm's security issues, what can be done, and why the npm registry is unique amongst programming language source code registries.
Changelog@changelog.com · 6mo ago💥 New Changelog interview! changelog.fm/674
![A screenshot of porffor.dev:
new! This page is served by a Porffor-compiled TS binary!
[live stats] memory 4.0mb | binary 287kb | requests 210 | uptime 3h 21m](https://cdn.bsky.app/img/feed_thumbnail/plain/did:plc:6plb5bwcopgjjkmyhrkktrbr/bafkreicxm7xhbwg6fwmcsnibjgenplt5xpkczowdby6eozjyueracrfnpq)
