Next-Gen JavaScript Package Management with Ruy Adorno and Darcy Clarke
Package management sits at the foundation of modern software development, quietly powering nearly every software project in the world. Tools like npm and Yarn have long been the core of the JavaScript ecosystem, enabling developers to install, update, and share code with ease. But as projects grow larger and the ecosystem more complex, this older infrastructure is beginning to show its limits with performance bottlenecks, dependency conflicts, and growing concerns around supply chain security.
Darcy Clarke and Ruy Adorno are veterans of this ecosystem. Both spent years maintaining the npm CLI and helping guide the Node.js project, where they saw firsthand the technical debt and design tradeoffs that define modern JavaScript tooling. Now they’re building vlt, a new package manager and registry that rethinks performance, security, and developer experience from the ground up.
In this episode, Darcy and Ruy join Josh Goldberg to discuss how vlt works, why they believe package management needs a server-side reboot, what lessons they’ve drawn from npm’s evolution, and how features like declarative querying, self-hosted registries, and real-time security scanning could reshape how developers build and share JavaScript in the years ahead.
Josh Goldberg is an independent full time open source developer in the TypeScript ecosystem. He works on projects that help developers write better TypeScript more easily, most notably on typescript-eslint: the tooling that enables ESLint and Prettier to run on TypeScript code. Josh regularly contributes to open source projects in the ecosystem such as ESLint and TypeScript. Josh is a Microsoft MVP for developer technologies and the author of the acclaimed Learning TypeScript (O’Reilly), a cherished resource for any developer seeking to learn TypeScript without any prior experience outside of JavaScript. Josh regularly presents talks and workshops at bootcamps, conferences, and meetups to share knowledge on TypeScript, static analysis, open source, and general frontend and web development.
Please click here to see the transcript of this episode.
Sponsorship inquiries: sponsor@softwareengineeringdaily.com
The post Next-Gen JavaScript Package Management with Ruy Adorno and Darcy Clarke appeared first on Software Engineering Daily.
688: Ex-npm Employee Making a New Package Manager?! Vlt with Darcy Clarke
In this supper club episode of Syntax, Wes and Scott talk with Darcy Clarke about his career path in tech, working with Wes back in the day, why he decided to build vlt volt, and the biggest sick pick list yet!
Show Notes 00:32 Welcome
01:38 Building a tweet wall back in the day
08:54 How did you land at npm?
npm
19:40 Why do we need another package manager and registry?
22:11 What is vlt volt?
vlt: a new home for open source
vlt /vōlt/ (@vltpkg) / X
Shipping ESM with Mark Erikson
Bun
Yarn
Nx
27:18 Do you see a future where we don’t pre-compile before shipping?
29:32 Why would pnpm be faster than npm?
31:14 What are the problems with symlinking?
33:08 What’s happening with Yarn?
Verdaccio
Cloudsmith
jfrong
Sonatype
socket.dev
Snyk.io
Dependency Confusion
37:42 What do you think about config files?
antfu Config of File Nesting for VS Code
The massive bug at the heart of the npm ecosystem
WebTorrent
41:02 VS Code tip - file nesting patterns
41:59 How does on-prem registry work?
47:29 Where does Socket.dev and Snyk security fit?
52:46 Sick Picks
04:41 How did you get vlt.sh?
05:30 How did you get @Darcy?
Sick Picks Flat Coat Goldendoodle
Scientific American
Nespresso
BlackBerry (2023) - IMDb
BlackBerry (2023) Letterboxd
Matthias Wandel
Blink-182 Official Site
Moneen
Bring Me The Horizon
Shameless Plugs vlt: a new home for open source
Hit us up on Socials! Syntax: X Instagram Tiktok LinkedIn Threads
Wes: X Instagram Tiktok LinkedIn Threads
Scott: X Instagram Tiktok LinkedIn Threads
The massive bug at the heart of npm
Darcy Clarke, former GitHub Staff Engineering Manager and founder of vlt, joins us to discuss a major bug in the npm ecosystem that he recently disclosed. We cover the bug’s timeline, nuances, and impact, all while setting some important context on npm packages, clients, and registries. Tune in to learn how to protect your codebase and gain a deeper understanding of this crucial part of the JavaScript ecosystem.
Join the discussion
Changelog++ members save 2 minutes on this episode because they made the ads disappear. Join today!
Sponsors:
Fastly – Our bandwidth partner. Fastly powers fast, secure, and scalable digital experiences. Move beyond your content delivery network to their powerful edge cloud platform. Learn more at fastly.com
Fly.io – The home of Changelog.com — Deploy your apps and databases close to your users. In minutes you can run your Ruby, Go, Node, Deno, Python, or Elixir app (and databases!) all over the world. No ops required. Learn more at fly.io/changelog and check out the speedrun in their docs.
Typesense – Lightning fast, globally distributed Search-as-a-Service that runs in memory. You literally can’t get any faster!
Changelog News – A podcast+newsletter combo that’s brief, entertaining & always on-point. Subscribe today.
Featuring:
Darcy Clarke – Website, GitHub, LinkedIn, Mastodon, X
Amal Hussein – GitHub, X
Feross Aboukhadijeh – Website, GitHub, X
Show Notes:
Darcy / vlt’s blog post on this massive npm bug
Feross / Socket’s follow-up blog post in this issue
Refactor Conf - Darcy & Feross will be speaking in July
Verdaccio (not to be mistaken with Versace) - an open source npm registry proxy
Github layoffs for engineering team in India
Bug filled July 28th, 2022 related to binding.gyp and triaged on October 22nd, 2022
Darcy’s original test POC from Nov 2nd, 2022
Darcy’s POC from March 8th, 2023 which was used in the HackerOne report to Github
Legacy docs for npm publish params
Tool for checking packages for manifest mismatches
Great resource for security acronyms
Something missing or broken? PRs welcome!
Front-end Developer Interview Questions (Interview)
Darcy Clarke joined the show to talk about his repo on the HTML5 Boilerplate org on GitHub “Front-end Developer Interview Questions”. We discussed why the repo has been so successful, the challenges of translating a text document into multiple languages, managing contributions, the art of interviewing, how the expectations of front-end developers have evolved over time, and how to stay relevant in our fast moving industry.
Join the discussion
Changelog++ members support our work, get closer to the metal, and make the ads disappear. Join today!
Sponsors:
Codeship – If it works with Docker, it works with Codeship Jet.
Toptal – Join Toptal and work with awesome people from anywhere in the world. Freelance with companies like Airbnb, Artsy & IDEO.
Code School – Learn to program by doing with hands-on courses. Sign up for Code School at only $19/month. That’s $10 off per month!
Featuring:
Darcy Clarke – Website, GitHub, LinkedIn, Mastodon, X
Adam Stacoviak – Website, GitHub, LinkedIn, Mastodon, X
Jerod Santo – Website, GitHub, LinkedIn, Mastodon, X
Show Notes:
Darcy is the creator of the Front-end Developer Interview Questions project on the H5BP org on GitHub – it’s “a list of helpful front-end related questions you can use to interview potential candidates, test yourself or completely ignore.”
At the end of the episode, we turned the tables on Darcy and asked him a few questions from the list.
“The goal is to try to have the (interview) question be more open ended, and hopefully it starts a discussion between the interviewer and interviewee.” - Darcy Clarke @ 12:28
“This document is like a high school english assignment, with over 100 group members, and they all have differing opinions, and there’s a ton of different subjects… It’s the worst kind of open source project.” - Darcy Clarke @ 22:56
h5bp/Front-end-Developer-Interview-Questions
darcyclarke (Darcy Clarke)
darcyclarke/DSS
Front-end Job Interview Questions | Darcy Clarke
What I learned interviewing with Google | Wes Bos
Join us on The Changelog (today?) · Issue #258 · h5bp/Front-end-Developer-Interview-Questions
How io.js built a 146 person, 27 language localization effort… in one day. — Medium
auduno/clmtrackr
The Changelog #67: HTML5 Boilerplate, Modernizr, and more with Paul Irish
Flipboard/react-canvas
Paul Irish
Wes Bos
Something missing or broken? PRs welcome!