A secure, pnpm-style package manager for Node.js that actively blocks supply-chain attacks before a single file is extracted.
$ npm install -g vaultpm
Installs the vault and vt commands. Vault's own
install runs zero postinstall scripts.
Not a scanner you run afterwards. The package manager itself is the guard.
Every package is checked against OSV.dev before download. Critical CVEs are blocked, not just reported.
Obfuscation-resistant scan of preinstall/postinstall for credential theft, exfiltration and eval-based payloads.
Flags freshly-published versions and maintainer-set changes between installs — the classic hijack pattern.
Catches look-alike names (expresss, crossenv) before you install the wrong thing.
Lifecycle scripts run under a kernel sandbox with no access to ~/.ssh, ~/.aws or the network.
pnpm-style global store + hard links. Ten projects on lodash = one copy on disk.
Socket-style analysis, built into a native package manager — open source.
| Vault | Socket / Aikido | snpm / rnpm | pnpm 10 / bun | |
|---|---|---|---|---|
| Is a package manager | ✓ | ✗ wraps npm | ✓ | ✓ |
| Pre-install CVE scan | ✓ | ✓ | partial | ✗ |
| Static script analysis | ✓ | ✓ | ✗ | ✗ |
| Kernel sandbox | ✓ Landlock | ✗ | ✗ | ✗ |
| Open source & self-contained | ✓ | ✗ SaaS | ✓ | ✓ |
Vault is the first open-source native package manager where the security analysis is built into the installer itself. See honest benchmarks.
Security usually means "slower". Vault refuses the trade-off — on a warm cache it's ~2× faster than pnpm (and level with it cold), while auditing every dependency.
| Package manager | Cold cache | Warm cache | Audits deps? |
|---|---|---|---|
| vault | 3.7s | 1.3s 🥇 | ✓ |
| pnpm | 2.8s | 2.1s | ✗ |
| npm | 8.0s | 3.5s | ✗ |
One back-to-back run · ~150-package tree · scripts disabled for all tools. Times vary with network; cold ordering vs pnpm flips run-to-run. Reproduce it: BENCHMARKS.md.
A malicious package is rejected on metadata alone — before any file touches disk.