Next-Gen JavaScript Package Management with Ruy Adorno and Darcy Clarke
Episode
57 min
Read time
2 min
Topics
Leadership, Marketing, Software Development
AI-Generated Summary
Key Takeaways
- ✓Server-side innovation gap: JavaScript package managers have only innovated client-side for fifteen years while using unchanged NPM registry APIs. Vlt introduces server-side optimization by pre-resolving dependency graphs centrally rather than having every machine redundantly compute the same resolutions, reducing wasted compute cycles across millions of developer installations worldwide.
- ✓Query selector syntax: Vlt implements CSS-inspired query language for package selection, enabling cross-project operations like updating social media links across 1000+ packages with conditions. Users can write selectors like host colon malware or not FS to find malicious packages or exclude packages requiring filesystem access, replacing bespoke filtering syntax with familiar patterns.
- ✓Safe-by-default execution: Vlt blocks arbitrary install scripts by default, requiring explicit allowlists via query selectors to run post-install code. This prevents supply chain attacks while letting developers opt into trusted packages needing native binary compilation. PNPM and Bun adopted similar approaches, marking industry shift away from automatic script execution.
- ✓Real-time security metadata: Vlt integrates Socket and other security vendors to enrich dependency graphs with malware flags, CVE types, filesystem access, and network permissions. Developers can gate installations on scan status, filter specific CWE types like regex denial-of-service, or audit all configured projects system-wide for newly-flagged malware using mutable selectors.
- ✓Self-hosted registry proxy: VSR runs locally as lightweight NPM-compatible proxy with private package support, offering round-trip performance benefits and comprehensive API documentation. Vlt provides interactive Scalar-based docs at slash docs endpoint, filling documentation gap left by NPM's undocumented registry APIs, enabling dev tools authors to build compatible tooling.
What It Covers
Darcy Clarke and Ruy Adorno, former NPM CLI maintainers, explain their new package manager Vlt and VSR registry. They address JavaScript dependency resolution challenges, server-side performance optimization through centralized graph resolution, CSS-inspired query selectors for package management, and integrated security scanning with real-time malware detection across projects.
Key Questions Answered
- •Server-side innovation gap: JavaScript package managers have only innovated client-side for fifteen years while using unchanged NPM registry APIs. Vlt introduces server-side optimization by pre-resolving dependency graphs centrally rather than having every machine redundantly compute the same resolutions, reducing wasted compute cycles across millions of developer installations worldwide.
- •Query selector syntax: Vlt implements CSS-inspired query language for package selection, enabling cross-project operations like updating social media links across 1000+ packages with conditions. Users can write selectors like host colon malware or not FS to find malicious packages or exclude packages requiring filesystem access, replacing bespoke filtering syntax with familiar patterns.
- •Safe-by-default execution: Vlt blocks arbitrary install scripts by default, requiring explicit allowlists via query selectors to run post-install code. This prevents supply chain attacks while letting developers opt into trusted packages needing native binary compilation. PNPM and Bun adopted similar approaches, marking industry shift away from automatic script execution.
- •Real-time security metadata: Vlt integrates Socket and other security vendors to enrich dependency graphs with malware flags, CVE types, filesystem access, and network permissions. Developers can gate installations on scan status, filter specific CWE types like regex denial-of-service, or audit all configured projects system-wide for newly-flagged malware using mutable selectors.
- •Self-hosted registry proxy: VSR runs locally as lightweight NPM-compatible proxy with private package support, offering round-trip performance benefits and comprehensive API documentation. Vlt provides interactive Scalar-based docs at slash docs endpoint, filling documentation gap left by NPM's undocumented registry APIs, enabling dev tools authors to build compatible tooling.
Notable Moment
The hosts revealed that SemVer specification only defines version numbers, not version ranges. Every package manager interprets range syntax differently without standardization, creating ecosystem-wide inconsistency. This fundamental ambiguity in how 1.1 or higher gets parsed explains why different package managers produce conflicting dependency resolutions for identical package specifications.
Episode Transcript
Package management sits at the foundation of modern software development, quietly powering nearly every software project in the world. Tools like npm and yarn have long been the core of the JavaScript ecosystem, enabling developers to install, update, and share code with ease. But as projects grow larger and the ecosystem more complex, this older infrastructure is beginning to show its limits with performance bottlenecks, dependency conflicts, and growing concerns around supply chain security. Darcy Clark and Rui Adorno are veterans of this ecosystem. Both spent years maintaining the NPM CLI and helping guide the Node. Js project, where they saw firsthand the technical debt and design trade offs that define modern JavaScript tooling. Now they're building Vault, a new package manager and registry that rethinks performance, security, and developer experience from the ground up. In this episode, Darcy and Ruri join Josh Goldberg to discuss how Vault works, why they believe package management needs a server side reboot, what lessons they've drawn from NPM's evolution, and how features like declarative querying, self hosted registries, and real time security scanning could reshape how developers build and share JavaScript in the years ahead. This episode is hosted by Josh Goldberg, an independent full time open source developer. Josh works on projects in the TypeScript ecosystem, most notably TypeScript ESLint, a powerful static analysis toolset for JavaScript and TypeScript. He is also the author of the O'Reilly Learning TypeScript book, a Microsoft MVP for developer technologies and a cofounder of SquiggleComp, a conference for excellent web developer tooling. Find Josh on Blue Sky, fostidon,and.com as Joshua k Goldberg. Darcy Clark and Voria Dorna, The Build Company. Welcome to Software Engineering Daily. How's it going? Good. Thanks for having us, Josh. Yeah. Thank you. Oh, I'm very excited. Just to start off, let's go and order alphabetically your first name. Darcy, who are you, and how did you come to work with the Volton package managers? So who I am, I'm a software engineer who has been developing, I would say, in JavaScript for at least about twenty years now. And I got into package management by jumping headfirst into the MPM Inc, the MPM company in 2019, was hired, and then shortly after, had brought on Roy and worked with him very closely. We're actually a part of the MPM or the acquisition of MPM by GitHub in 2020, and that was a pretty exciting time for us. We got to see what it's like to work at both a fast moving and rocket ship of a venture backed start up. And then we also got to see what it was like to go into a very large enterprise company, and that was also being acquired by the largest enterprise company, I e, Microsoft. And, yeah, we got to support the world's largest package registry, and I really enjoyed the space. And I I really care deeply about community and open source. So, yeah, just fell in love many, many years ago …
Get the full transcript (10,113 words) + summary by email — free
One-time email with the complete transcript and AI summary of this episode. No account needed.
One email, no spam. We’ll also show you what SignalCast does.
You just read a 3-minute summary of a 54-minute episode.
Get Software Engineering Daily summarized like this every Monday — plus up to 2 more podcasts, free.
Pick Your Podcasts — FreeKeep Reading
More from Software Engineering Daily
SED News: The NVIDIA-Hugging Face Deal, China’s Proxy Economy, the Open Weight Surge
Sep 8 · 52 min
Lenny's Podcast
The art of influence: The single most important skill that AI can’t replace | Jessica Fain (Webflow, ex-Slack)
Mar 22
More from Software Engineering Daily
Moving Beyond RAG with Precomputed Context
Sep 3 · 55 min
The Product Experience
How to align product work to business goals | Corinna Stukan (CEO, Bizzy)
Feb 25
Books, tools, and gear mentioned in this episode
SignalCast may earn commission on purchases via these links.
Tools
“Darcy Clarke and Ruy Adorno, former NPM CLI maintainers, explain their new package manager Vlt and VSR registry.”
“PNPM and Bun adopted similar approaches, marking industry shift away from automatic script execution.”
“Darcy Clarke and Ruy Adorno, former NPM CLI maintainers, explain their new package manager Vlt and VSR registry.”
“PNPM and Bun adopted similar approaches, marking industry shift away from automatic script execution.”
“Vlt integrates Socket and other security vendors to enrich dependency graphs with malware flags, CVE types, filesystem access, and network permissions.”
“Vlt provides interactive Scalar-based docs at slash docs endpoint, filling documentation gap left by NPM's undocumented registry APIs.”
More from Software Engineering Daily
We summarize every new episode. Want them in your inbox?
SED News: The NVIDIA-Hugging Face Deal, China’s Proxy Economy, the Open Weight Surge
Moving Beyond RAG with Precomputed Context
The Death of Online Anonymity
TypeScript 7 and What Comes Next
The Gap Between AI Spending and AI Value
Similar Episodes
Related episodes from other podcasts
Lenny's Podcast
Mar 22
The art of influence: The single most important skill that AI can’t replace | Jessica Fain (Webflow, ex-Slack)
The Product Experience
Feb 25
How to align product work to business goals | Corinna Stukan (CEO, Bizzy)
The Meb Faber Show
Nov 11
The Biotech Rebuild: Finding Alpha After the Drawdown with Chris Clark | #606
Eye on AI
Sep 8
86% of What Coding Agents Do Is Just Reading — Not Solving | Alexander Whedon of Subquadratic
How I AI
Sep 7
Build your own company brain: the enterprise AI playbook from Stripe’s engineering team | Sharadh Krishnamurthy
Explore Related Topics
This podcast is featured in Best Cybersecurity Podcasts (2026) — ranked and reviewed with AI summaries.
Read this week's Software Engineering Podcast Insights — cross-podcast analysis updated weekly.
You're clearly into Software Engineering Daily.
Every Monday, we deliver AI summaries of the latest episodes from Software Engineering Daily and 192+ other podcasts. Free for one show.
Start My Monday DigestNo credit card · Unsubscribe anytime