vlt 1.0 Ships as a Drop-in npm Replacement with Phased Installs, Graph Queries, and Malware-Blocking

vlt 1.0 发布：作为 npm 的直接替代品，支持分阶段安装、图形查询和恶意软件拦截

作者：Daniel Curtis · InfoQ 原文

摘要：由 npm 原班人马构建的 JavaScript 包管理器 vlt 发布 1.0 版本，可作为 npm 的直接替代品。新功能包括分阶段安装（阻止依赖脚本自动运行）、可查询的依赖关系图（支持 60 多个 CSS 类选择器）以及托管注册表（在提供前拦截已知恶意包）。vlt 的安装和构建分离，确保默认情况下不执行恶意脚本，同时通过集成的 Socket 安全功能增强依赖审计。

vlt, the JavaScript package manager and registry built by the original creators of npm, has released vlt 1.0, shipping as a drop-in npm replacement alongside the general availability of its hosted package registries and ecosystem mirrors.

由 npm 原班人马构建的 JavaScript 包管理器及注册表 vlt 发布了 vlt 1.0，作为 npm 的直接替代品，同时其托管包注册表和生态系统镜像也正式上线。

vlt 1.0 introduces several capabilities, including phased installations that stop dependency scripts from running automatically, a queryable dependency graph with more than 60 CSS-like selectors, and hosted registries that reject known-malicious packages before they are served.

vlt 1.0 引入了多项功能，包括阻止依赖脚本自动运行的分阶段安装、包含 60 多个 CSS 类选择器的可查询依赖关系图，以及在提供服务前拒绝已知恶意包的托管注册表。

Founder Darcy Clarke announced the release on X, describing a client "built so nothing runs on your machine just because you typed install."

创始人 Darcy Clarke 在 X 上宣布了发布，并描述该客户端“构建得如此之好，以至于你不会因为输入了 install 就让任何东西在你的机器上运行”。

Where npm downloads, extracts, and runs lifecycle scripts in one step, vlt splits the process in two.

npm 下载、解压并运行生命周期脚本是一步完成的，而 vlt 则将这个过程分为两步。

vlt install downloads and extracts packages without executing anything, and vlt build then runs scripts only for the packages you trust, skipping anything flagged as malware by default:

vlt install 下载并解压包，但不执行任何内容；vlt build 则为您信任的包运行脚本，默认跳过任何被标记为恶意软件的内容：

$ vlt install # downloads packages, no scripts run

$ vlt install # 下载包，不运行脚本

$ vlt build # runs approved scripts, blocks known malware

$ vlt build # 运行批准的脚本，阻止已知恶意软件

The second standout is vlt query, a dependency selector syntax that treats the graph like a DOM tree.

第二个亮点是 vlt query，这是一种将依赖关系图视为 DOM 树的依赖选择器语法。

Around half of the 60-plus selectors are security focused and powered by a Socket integration, letting teams audit dependencies at scale, while a :host(local) selector extends queries across every project on a machine.

60 多个选择器中约有一半专注于安全性，并由 Socket 集成提供支持，使团队能够大规模审计依赖关系；同时 :host(local) 选择器将查询扩展到机器上的每个项目。

The --view=mermaid flag renders the matched dependencies as a diagram.

--view=mermaid 标志将匹配的依赖项渲染为图表。

On Hacker News, where the launch reached the front page, one commenter welcomed it as something that "will benefit the entire ecosystem," while others struggled with the pitch, with one asking plainly what the service is and to "pitch me in five seconds or less."

在 Hacker News 上，该发布登上了首页，一位评论者表示欢迎，认为其“将惠及整个生态系统”，而其他人则难以理解其宣传要点，有人直接询问该服务是什么，并要求“用五秒或更短的时间向我推销”。

to which Clarke responded:

对此 Clarke 回应道：

5s: save time & money

5 秒：节省时间和金钱

10s: vlt helps engineering teams build JavaScript software faster, reduce supply chain risk, and lower infrastructure costs (via. API perf / payload optimizations).

10 秒：vlt 帮助工程团队更快地构建 JavaScript 软件，降低供应链风险，并通过 API 性能/有效负载优化降低基础设施成本。

20s: If you've used npm for years & are just narrowly escaping the various malware attacks or are on the hook for running up CI/agent bills at work because cold installs are X percent of the time compared to your actual builds/runtime, then you should check us out.

20 秒：如果您已经使用 npm 多年，并且只是勉强逃脱了各种恶意软件攻击，或者因为冷启动安装时间占了实际构建/运行时间的 X% 而承担高昂的 CI/代理费用，那么您应该来了解一下我们。

After a year of supply chain attacks such as the Shai-Hulud worm, npm v12 now disables install scripts by default, pnpm quarantines fresh releases with a minimum release age, and Bun blocks postinstall scripts too.

在经历了一年诸如 Shai-Hulud 蠕虫等供应链攻击后，npm v12 现在默认禁用安装脚本，pnpm 通过对新版本设置最小发布年龄来进行隔离，Bun 也阻止了 postinstall 脚本。

vlt goes further by rejecting bad packages at the registry, having flagged more than 275,000 package versions, a quarter of which reviewers note are still installable on npm.

vlt 更进一步，在注册表层面拒绝不良包，已标记超过 275,000 个包版本，其中评论者指出有四分之一在 npm 上仍然可以安装。

On raw install speed, though, pnpm and Bun still lead, and vlt reports its registry as up to 38% faster than npm rather than the fastest overall.

不过，在原始安装速度方面，pnpm 和 Bun 仍然领先，vlt 报告其注册表比 npm 快 38%，而不是整体上最快的。

For developers who are interested, migrating steps are small and fairly straightforward.

对于感兴趣的开发者来说，迁移步骤很少且相当直接。

After npm install -g vlt, teams can run vlt install and vlt build in an existing project, with configuration moving from .npmrc to vlt.json and a new vlt-lock.json lockfile, as covered in the migration guide.

在运行 npm install -g vlt 之后，团队可以在现有项目中运行 vlt install 和 vlt build，配置从 .npmrc 迁移到 vlt.json，并使用新的 vlt-lock.json 锁文件，迁移指南中有详细说明。

The npm-compatible registry API means existing CI pipelines, private registries, and tooling keep working.

与 npm 兼容的注册表 API 意味着现有的 CI 管道、私有注册表和工具仍可继续工作。

vlt is free and open source under a BSD-2-Clause-Patent license, developed by vlt technology inc. and available now with npm i -g vlt.

vlt 是免费开源的，采用 BSD-2-Clause-Patent 许可证，由 vlt technology inc. 开发，现在可以通过 npm i -g vlt 获取。

阅读理解

1. What is a key difference between npm and vlt's installation process?

2. According to the article, what is the purpose of vlt's `--view=mermaid` flag?

3. What does the article suggest about vlt's performance compared to other package managers?

温故复习 →每日一句 →