Darcy Clarke

⚡️ We're looking for a DevRel person at @vlt.sh - based in our Toronto 🇨🇦 HQ. You'll work closely w/ me & should love the idea of owning various aspects of product marketing. You'll be vlt's biggest fan & advocate; molding this unique role in a way that plays to your strengths & ours.

Thank You, Deno, by @darcyclarke.me (@vlt.io): https://www.vlt.io/blog/competition-keeps-javascript-moving?ref=frontenddogma.com #deno #runtimes

Our benchmarks got a fresh look, with new ways to explore performance, and a few new capabilities for agentic tooling. Read about some of our favourite changes ↓ www.vlt.io/blog/more-th...

🚀 Just shipped a new `vlt skills` cmd as part of v1.5.0 of the vlt CLI so that we can properly manage these skills that are already being shipped in packages. #javascript #packages #vlt

🚀 vlt@1.4.0 is out with faster installs for macos and a new `--save-types` option to automatically add type dependencies. And more! Read more about it here: www.vlt.io/blog/vlt-1-4

Shared some thoughts on the recent acquisition...

@vlt.io got added! Shout out to @andrewnez.bsky.social who has been doing awesome work/writing a ton about packaging ecosystems for forever. Don't sleep on his articles/updates/ecosyste.ms

The #vlt client now has an 'outdated' command! Read all about it: www.vlt.io/blog/vlt-out...

on the ⚡️ @vlt.io ⚡️ registry we serve metadata that is 70% smaller which is one reason (out of many!) that we're able to do clean installs in 20-70% less time when you point to our registry vs npmjs.org. i wrote about how we did it:

Thanks @vlt.io for contributing! 🔈 audio on to hear it from @nodeland.dev

Thank you everyone for joining us at #NodeConfEU 2026! 💚 We hope you enjoyed it as much as we did, and we can’t wait to see you again next year! 📅👩‍💻 #TechCommunity #NodeCommunity

A new home for your open source... In case you're fed up with that old one

I've been back to improving the vlt CLI for the last month, here's a peek at what we shipped since our major v1.0 release! 🚀 www.vlt.io/blog/vlt-cli...

🚀 Thrilled to announce @vlt.io as a #Silver #Sponsor of #NodeConfEU 2026! Thank you! 💛 Your partnership is helping us create something truly special in the #Node.js #community! 🎟️ nodeconf.eu

Dependency hell!! Oh no, w @darcyclarke.me at @nodejs.org Interactive at @renderatl.com #NodeJSInteractive

⛰️ mountx :: mount JavaScript as a real filesystem! Write ~6 lines of JS, get a real directory any process can read & write: editors, CLIs, AI agents. Rootless on Linux (FUSE) and macOS (NFSv3 with no kernel extensions). ~Pure JS, zero deps. mountx.vercel.app

A familiar story: the build crashes, so you rm -rf node_modules && rm package-lock.json, then reinstall to get your dev env back. But once the lockfile's gone, your ^ ranges take over. npm install can grab the newest in-range version of everything: poison included when there's a supply chain attack

Love to see all the pieces coming together! Just ran a `vlt publish --scope=':workspace'` cmd that mass-publishes all my workspaces in a given project to a private registry in my vlt.io account ❤️

There is CSS... but what if I told you there is such a thing as DSS? Dependency Selector Syntax is an expressive DSL written as a homage to CSS. Use it to inspect malicious dependencies in your repo docs.vlt.io/cli/selector...

If you regularly publish to the npm registry, you might be concerned about package size 😁 But have you heard of PACKUMENT size? News flash: how often you publish, how long your manifest is, how many *exports* you have, can also eventually prevent you from publishing!

13 years ago today I made the first commit to the ESLint Git repo. It’s hard to believe that this project I cobbled together in my spare time over a couple of weeks is still going strong. I’ve been doing a lot of reflecting over these years and the journey it’s been. A thread.

Today is a big day for @socket.dev. We raised a $60M Series C at a $1B valuation, led by Thrive Capital. 20,000+ orgs, 1.5M repos protected, 1,000+ supply chain attacks blocked per week. 3/5 FAANG companies are customers. We're just getting started.

today is a great day to rm -rf your work computer so you can take a little break

84 TanStack npm package artifacts were compromised in the ongoing Mini Shai-Hulud supply chain attack, adding suspected CI credential-stealing malware. Socket flagged every malicious version within six minutes of publication. Details: socket.dev/blog/tanstac...

The hidden gem is that @nodejs.org majors and LTS cycles got WAY easier to understand: 2026 -> v26 2027 -> v27 2028 -> v28 ... Aall of them go LTS for 18 months meaning each major is supported for 2 years. The new graphic tells the best story here: nodejs.org/en/blog/anno...

While others race away from Open Source, @vlt.sh is doubling down. 🖤⚡ Today we’re announcing our renewed commitment to @opensourcepledge.com and investing back into the ecosystem. www.vlt.io/blog/doublin...

porffor.dev is now served by a Porffor-compiled TS native binary!

this is one of my favorite parts of the @vlt.sh CLI. it uses @socket.dev security data to prevent known malware from running lifecycle scripts like postinstall! and it’s powered by queries under the hood so you could make it as granular as you wanted (but we ship with safe defaults)

We’re seeing cases where teams can’t explain how they were compromised by the Axios incident because it doesn’t show up in their project's lockfile. The blast radius here is much larger than it looks. Deep dive into the messy reality of modern dependency resolution → socket.dev/blog/hidden-...

tldr; if you used @vlt.sh as your package manager, then you were protected the minute @socket.dev flagged the malicious packages in the `axios` attack yesterday. The best time to switch your package manager was 48hrs ago, the next best time is right now. More below: blog.vlt.sh/blog/vlt-build

I'm still waiting on the "Vestro" announcement from @vercel.com today - where it's a slop fork of Astro...

🙌