Ruy Adorno
@ruyadorno.com
Node.js TSC • Founder Engineer at @vlt.sh • Previously Google, GitHub, npm Inc. Opinions are my own. 📍 Montreal 🇨🇦
We just released the first version of the vlt.io platform! 🚀 This is just the beginning, as we start to tackle the challenge of securing the JavaScript packages ecosystem and making it faster. Make sure to sign up and follow us at @vlt.io 😊 #javascript #nodejs #package
Home | vlt /vōlt/
Package registries for teams that move fast
vlt.io
if you see me posting a bunch of patch releases in the next few days, and any of them happen to maybe have a casual new feature, here is the rationale 😅
luke karrys@lukekarrys.com · 18h ago"it's a patch release because it was a bug that we forgot to include that feature previously"
Another sudden drop of great news! As if staying on top of the supply chain security improvements in the JS ecosystem was not a full time job already 😅
Darcy Clarke@darcyclarke.me · 24h agoExcited to share vlt 1.0 along with our hosted registries & ecosystem mirrors now GA! A drop-in npm replacement, built so nothing runs on your machine just because you typed install. → faster delivery → malware blocking at the registry layer → graph-native querying
Congratulations for the launch!!! 🚀
Darcy Clarke@darcyclarke.me · 24h agoExcited to share vlt 1.0 along with our hosted registries & ecosystem mirrors now GA! A drop-in npm replacement, built so nothing runs on your machine just because you typed install. → faster delivery → malware blocking at the registry layer → graph-native querying
🎉 it's launch day at @vlt.io! 🎉 - use our new drop-in npm replacement to protect yourself from malware and increase performance - create private registries to share packages with your team - oh and the vlt CLI is now v1! read more in our announcement post:
vlt 1.0 & Hosted Package Registries | vlt /vōlt/
Stable client release and general availability of hosted registries & ecosystem mirrors.
vlt.io
Proud to see the vlt team launch their hosted registries 💪
Darcy Clarke@darcyclarke.me · 24h agoExcited to share vlt 1.0 along with our hosted registries & ecosystem mirrors now GA! A drop-in npm replacement, built so nothing runs on your machine just because you typed install. → faster delivery → malware blocking at the registry layer → graph-native querying
At work I've been working on a safer, faster NPM mirror and place for teams to publish private packages. After roughly 8 months we're done! It's been a ride https://vlt.io/ #vlt #npm
Home | vlt /vōlt/
Package registries for teams that move fast
vlt.io
Excited to share vlt 1.0 along with our hosted registries & ecosystem mirrors now GA! A drop-in npm replacement, built so nothing runs on your machine just because you typed install. → faster delivery → malware blocking at the registry layer → graph-native querying
🥁 𝐒𝐩𝐞𝐚𝐤𝐞𝐫 𝐀𝐧𝐧𝐨𝐮𝐧𝐜𝐞𝐦𝐞𝐧𝐭🎙️ Thrilled to have Filip Skokan on the NodeConf EU 2026 stage! He'll tell us the story of "𝐏𝐨𝐬𝐭-𝐐𝐮𝐚𝐧𝐭𝐮𝐦 𝐂𝐫𝐲𝐩𝐭𝐨𝐠𝐫𝐚𝐩𝐡𝐲 𝐢𝐧 𝐍𝐨𝐝𝐞.𝐣𝐬". 🎟️Don't miss it out, secure your tickets www.nodeconf.eu
⚠️ Node.js Security Update: Updates are now available for the 26.x, 24.x, 22.x release lines. Details: https://nodejs.org/en/blog/vulnerability/july-2026-security-releases
Node.js — Wednesday, July 29, 2026 Security Releases
Node.js® is a free, open-source, cross-platform JavaScript runtime environment that lets developers create servers, web apps, command line tools and scripts.
nodejs.org
npm is now scanning packages for malware at publish time before they become available for consumption
npm publish-time malware scanning and dual-use metadata - GitHub Changelog
As part of our ongoing supply-chain security work, npm is introducing automatic scanning of packages at publish time. This changelog covers what publishers can expect and a new metadata requirement…
github.blog
Don't forget! Tickets are on sale now for @nodeconf.eu The conference is being held in beautiful Bologna, Italy on September 29th and 30th We've got a fantastic agenda, wonderful sponsors, and Italian food. The food alone is worth the trip.
As expected when npm starts blocking install scripts, malware just shifts to import-time.
Socket@socket.dev · last wk.🚨 Two Joyfill npm beta releases were compromised with an import-time implant that resolves encrypted payloads through Tron, Aptos, and BNB Smart Chain transactions to load a Node.js RAT: • @joyfill/layouts@0.1.2-2773.beta.0 • @joyfill/components@4.0.0-rc24-2773-beta.4
Your AI assistant just suggested an npm package. It looks real, it's well-named, it solves your exact problem. It also never existed until an attacker registered the name & filled it with malware. That's slopsquatting. 🧵
We’ve reached out to service providers associated with the domain, and can happily report that corepack[dot]org has been taken down. As a reminder, the only official Node.js site is nodejs.org.
Node.js — Run JavaScript Everywhere
Node.js® is a free, open-source, cross-platform JavaScript runtime environment that lets developers create servers, web apps, command line tools and scripts.
nodejs.org
Socket@socket.dev · 2w agoA fake corepack site at corepack[.]org is impersonating the Node.js Corepack tool and pushing malware to developers. The download button drops an infostealer that steals browser data and SSH keys, plus proxyware that turns your machine into a proxy node. socket.dev/blog/fake-co...
The average node_modules has more contributors than most companies have employees. We just never see their faces.
Did you know Node.js is redesigning its API documentation? The new beta brings faster navigation, improved search, richer type information, better mobile support, version switching, and so much more. Learn more & preview today at nodejs.org/en/blog/anno...
Node.js — Check out the New Node.js API Documentation Preview
Node.js® is a free, open-source, cross-platform JavaScript runtime environment that lets developers create servers, web apps, command line tools and scripts.
nodejs.org
A familiar story: the build crashes, so you rm -rf node_modules && rm package-lock.json, then reinstall to get your dev env back. But once the lockfile's gone, your ^ ranges take over. npm install can grab the newest in-range version of everything: poison included when there's a supply chain attack
Ship JavaScript? Hang onto your lockfile | vlt /vōlt/
Pinning dependencies in package.json won't save you in a supply-chain attack — a committed lockfile does. Here's why, and how to install so it holds.
vlt.io
Love to see all the pieces coming together! Just ran a `vlt publish --scope=':workspace'` cmd that mass-publishes all my workspaces in a given project to a private registry in my vlt.io account ❤️
Home | vlt /vōlt/
Package registries for teams that move fast
vlt.io
I just blogged: "Using a SSH bastion, but only when I'm touching grass" https://evertpot.com/ssh-tunnel-if-unresolvable/
my sister is an incredible artist and therapist. she made me a ceramic mask that hangs in my living room that is one of my prized possessions. she was accepted into an artist residency in italy and has a kickstarter to raise money for her to go. one of the tiers is your very own one-of-a kind masks!
Julia's Italian Art Residency
Please support my participation in the two-week interdisciplinary artist residency Baroque Blue Art & Nature Residency in Italy!
kickstarter.com
There is CSS... but what if I told you there is such a thing as DSS? Dependency Selector Syntax is an expressive DSL written as a homage to CSS. Use it to inspect malicious dependencies in your repo docs.vlt.io/cli/selector...
🎟️ NodeConf EU 2026 — tickets are live! September 29-30 · Bologna, Italy Hotel Savoia Regency Two days of talks, conversations, and the hallway track that makes this conference worth the trip.
Anyone using --use-largepages in real-world deployments? Just opened an issue about possibly deprecating it (if nobody is using it) to reduce the maintenance churn github.com/nodejs/node/...
Future of `--use-largepages=on` · Issue #64408 · nodejs/node
This was added back in 2018, some background can be found in this issue #16198 - from what I can tell we opted into a user-land relocation to work around the fact that for most kernels in the wild,...
github.com
I noticed npm is finally pushing out some of the breaking changes that I wanted to push 5 years ago, so I decided to write something about it, mostly to report and raise awareness that these changes are coming 😊 www.vlt.io/blog/npm-12-...
Beyond disabling postinstalls: how npm install will change in npm 12 | vlt /vōlt/
As part of its planned 12th release, the npm CLI drops automatically running lifecycle scripts on installs as part of multiple planned breaking changes
vlt.io
Landed a few improvements to the error reporting for require(esm) with top-level await (behind --experimental-print-required-tla for now): - No longer need to run the code to collect the TLA locations, so it can be enabled by default soon - Added require stack and location metadata to the error
If you regularly publish to the npm registry, you might be concerned about package size 😁 But have you heard of PACKUMENT size? News flash: how often you publish, how long your manifest is, how many *exports* you have, can also eventually prevent you from publishing!
Why Drizzle ORM couldn't publish new releases on NPM for a month | vlt /vōlt/
Drizzle ORM recently hit a 100 MB limit in the npm registry and couldn't ship new releases for weeks. What is this limit?
vlt.io
Why Drizzle ORM couldn't publish new versions to NPM for a month: www.vlt.io/blog/packume...
Why Drizzle ORM couldn't publish new releases on NPM for a month | vlt /vōlt/
Drizzle ORM recently hit a 100 MB limit in the npm registry and couldn't ship new releases for weeks. What is this limit?
vlt.io
