Your AI agent just installed 47 packages you didn't read. One is malicious. The registry served it anyway.
When agents control dependencies, who validates?
vlt /vōlt/
@vltpkg
JavaScript package registries & tooling for teams that move fast.
Joined March 2023
- Semantic Versioning solved "Is this compatible?"—but that's just the version number. Provenance, integrity, SBOMs—fragmented. What if we built *on* semver instead of replacing it? Darcy Clarke at Render ATL, Wed 2pm ET. renderatl.com/node What's your priority?
- Semantic Versioning solved "Is this compatible?"—but not "is this safe?" Provenance, integrity, SBOMs—all fragmented. Tomorrow, Darcy Clarke asks bigger question: can we build *on* semver instead replacing it? @RenderATL, Weds 2pm ET. renderatl.com/node Attending?
- Wake up in the morning to a feed full of CLIs 🎶
- You've got an SBOM. Your team trusts it. But what's actually shipping in your node_modules? Most teams can't answer that. An SBOM is a snapshot of declared dependencies. Your actual graph—what specs resolved to, what got yanked, what changed at publish time—is invisible. That
