vlt splits install and build to block malware by default
Separating download and script execution creates a security floor that prevents automatic execution of potentially harmful code, shifting trust decisions to explicit user approval and enabling safer dependency management.
Frame 1 of 4
vlt 1.0 launches with phased installs and malware blocking
vlt 1.0, created by npm’s original authors, ships as a drop-in replacement that splits package installation into two commands: 'vlt install' downloads packages without running scripts, and 'vlt build' runs only trusted scripts, blocking known malware by default. It also introduces a queryable dependency graph with CSS-like selectors for auditing.