Freedom251 › JavaScript Package Managers

vlt

Free plan Self-hostedWeb

What vlt is

vlt is a package registry and management tool for JavaScript teams. It supports npm-compatible publishing of scoped and private packages, along with organization and access management. It is available as a web service or for self-hosting, and teams can publish through vlt, npm, pnpm, yarn, bun, deno, or CI. Its command-line client handles installation, publishing, configuration, execution, and dependency queries. Users can examine resolved dependency graphs, trace why dependencies are present, and query the graph with selector syntax. For package delivery, vlt describes using caching and smaller payloads while remaining compatible with existing team tools. Its registry says it scans a safe npm mirror for malware and advisories, and restricts or disables lifecycle scripts by default; risky behavior requires explicit approval. vlt also describes dependency-risk identification through Socket. The Free plan costs nothing. Pro is $8 a month, billed annually; Premium is $20 a month, billed annually, with a two-seat minimum. Enterprise is $79 a month, billed annually, with a ten-seat minimum.

Who it suits

The Free plan is aimed at developers trying vlt for the first time. Paid options are described for developers needing more bandwidth, growing teams, and large organizations with advanced needs.

What it does well

Supports self-hosting and web access.
Accepts publishing from common package tools and CI.
Dependency graphs can be queried with selector syntax.
Lifecycle scripts are restricted or disabled by default.
Free plan includes 2GB storage and delivery.

What to know first

Pro and Premium are billed annually.
Premium requires at least two seats.
Enterprise requires at least ten seats.
SSO/SAML and activity logs are listed as coming soon.

Limits

The Free plan includes 2GB Storage+Delivery. Pro includes 10GB, Premium includes 50GB and requires at least 2 seats, and Enterprise includes 1TB and requires at least 10 seats; additional usage on Pro and Premium is billed per GB.

Plans

Plan	Billed and limits	Price
Free	2GB Storage+Delivery · Upstream Proxy · User Management · Token Management · Community Support	Free
Premium	Billed annually · Min 2 seats · 50GB Storage+Delivery · Additional Usage Billed Per GB	$20 a month
Enterprise	Billed annually · Min 10 seats · 1TB Storage+Delivery · SOC 2 Type II Report · Dedicated Support Channel · SSO / SAML (coming soon) · Activity Logs (coming soon)	$79 a month
Pro	Billed annually · 10GB Storage+Delivery · Additional Usage Billed Per GB · Chat and email support	$8 a month
Enterprise+	Custom solutions	On request

As vlt.io lists them, read 30 Sept 2026. The maker's own page has the final word.

Getting started

Visit the vlt website.
Choose the web or self-hosted option.
Select a plan: Free, Pro, Premium, Enterprise, or Enterprise+.
Use the vlt client to install packages or use a supported package manager to publish them.
Connect publishing through vlt, npm, pnpm, yarn, bun, deno, or CI.

Verdict

vlt combines npm-compatible package management with dependency inspection and stated registry protections. The Free plan includes community support, while paid plans add higher storage and delivery allowances or dedicated support.

Questions

Is there a free plan?

Yes. Free costs nothing and includes 2GB Storage+Delivery, an upstream proxy, user and token management, and community support.

What do the paid plans cost?

Pro is $8 a month, billed annually. Premium is $20 a month, billed annually, with a 2-seat minimum. Enterprise is $79 a month, billed annually, with a 10-seat minimum. Enterprise+ has custom solutions and no listed price.

Which platforms does vlt support?

vlt is available on the web and as a self-hosted service.

Can teams publish packages with other package managers?

Yes. The documentation describes publishing with vlt, npm, pnpm, yarn, bun, deno, or from CI.

What security controls are included?

vlt describes advisory and malware scanning across a safe npm mirror, restrictions on lifecycle scripts by default, and Socket integration for identifying dependency risks. Its security policy specifies TLS 1.2 or later and MFA for high-risk systems.

What does Enterprise include?

Enterprise includes 1TB Storage+Delivery, a SOC 2 Type II report, and a dedicated support channel. SSO/SAML and activity logs are listed as coming soon.

Facts from vlt's own pages

Audience: The pricing page describes Free as for developers trying vlt for the first time, Pro for developers needing extra bandwidth, Premium for growing teams, and Enterprise for large organizations with advanced needs. · vlt.io, 30 Sept 2026
CLI: The vlt client includes commands for package installation, publishing, configuration, execution, and dependency queries. · vlt.io, 30 Sept 2026
Compliance: The pricing page lists a SOC 2 Type II report with the Enterprise plan; it lists SSO/SAML and activity logs as coming soon. · vlt.io, 30 Sept 2026
Dependency graph: vlt lets users explore resolved dependency graphs, trace why dependencies exist, and query them with selector syntax. · vlt.io, 30 Sept 2026
Dependency security integration: The documentation describes security-risk identification through vlt's integration with Socket. · docs.vlt.io, 30 Sept 2026
Install security: Lifecycle scripts are restricted or disabled by default, and risky behavior requires explicit approval. · vlt.io, 30 Sept 2026
Integrations: The documentation says packages can be published using vlt, npm, pnpm, yarn, bun, deno, or from CI. · docs.vlt.io, 30 Sept 2026
Package delivery: The registry uses JavaScript-focused infrastructure with caching and smaller payloads while remaining compatible with existing team tools. · vlt.io, 30 Sept 2026
Private registry option: The VSR project describes an npm-compatible private registry that can run locally or in CI and supports granular access tokens. · vlt.io, 30 Sept 2026
Product: vlt provides npm-compatible JavaScript package registries for teams to publish scoped and private packages and manage organizations and access. · vlt.io, 30 Sept 2026
Registry protection: The registry says it blocks known malware and high-risk software, backed by continuous advisory and malware scanning across a safe npm mirror. · vlt.io, 30 Sept 2026
Security controls: vlt's security policy states that traffic is encrypted with TLS 1.2 or later and MFA is required for high-risk systems. · vlt.io, 30 Sept 2026
Support: The Free plan includes community support, Pro includes chat and email support, and Enterprise includes a dedicated support channel. · vlt.io, 30 Sept 2026

Where vlt stands on Freedom251

JavaScript Package Managers#15 of 19