@vltpkg Founder & Chief End-User Officer Prev: @GitHub @npmjs Staff EM & @Themify Co-Founder Proudly 🇨🇦 & investing here...
Toronto
- Tweets 9,330
- Following 2,155
- Followers 6,060
- Likes 11,659
Darcy Clarke retweeted
The recent node.js RCE related to brotli compression is broader than just node.js and applies to essentially all software using brotli[1]
Vercel’s firewall protection against the attack is effective independent of the backend technology.
Python is vulnerable. However, unlike Node.js it requires using the pypi/brotli package explicitly[2].
It is likely that other software is impacted. Attacks can happen both through decoding incoming HTTP requests (which the Vercel Firewall protects against) as well as downloading attacker-controller payloads via HTTP.
[1] cve.org/CVERecord?id=CVE-202…
[2] db.gcve.eu/vuln/PYSEC-2026-4…
Node.js Security Advisory: a high-severity RCE flaw in Node's Brotli decoder affects Node.js 22, 24, and 26.
Vercel WAF rules are live for every project and block known exploit patterns.
vercel.com/kb/bulletin/node-…
19
16
158
18,940
💅🏻 Our benchmarks got a major redesign this week. Since 2024, this suite has kept us honest & the ecosystem fast.
We've seen tremendous (re)investment/pace in perf over the years & make no mistake, competition is a good thing for our ecosystem!
Great work @pkg_json! 🔥🚀😍
Our benchmarks got a fresh look, with new ways to explore performance, and a few new capabilities for agentic tooling.
Read about some of our favourite changes ↓
vlt.io/blog/more-than-just-n…
5
348
We've been discussing this quite a bit recently at @vltpkg ... I swear I've never used "ack" to mean "acknowledged"
in work Slack, I get caught in the confusing cross-fire of people who say “ack” to mean “I acknowledge this message” and people who remember Cathy comics
ALT a panel from the Cathy comic where she’s yelling “ACK!” over and over
2
8
543
Darcy Clarke retweeted
Waterloo grads btw
@sequoia is leading our Series C at a $1B valuation.
Since January, we’ve gone from running 5M CI jobs a week to over 90M. Agents are writing an order of magnitude more code, and all of it still needs to be built and tested before it ships.
11
6
183
6,884
Darcy Clarke retweeted
.@vltpkg 1.5.0 links agent skills from your dependencies to coding agents, with versions pinned by your lockfile.
The default skills filter uses Socket data to exclude packages flagged as malware before their instructions reach your agents.
socket.dev/blog/vlt-skills
2
7
18
2,459
Darcy Clarke retweeted
@sequoia is leading our Series C at a $1B valuation.
We started Blacksmith in 2024 to make CI faster and less painful. In January we ran 5 million CI jobs a week. Today it's over 90 million and growing, and we’re still early.
ALT Line chart of weekly CI jobs run on Blacksmith, growing from 5.4M in January to 90.5M in October 2026.
82
31
602
114,744
Darcy Clarke retweeted
🚀 Just shipped a new `vlt skills` cmd as part of v1.5.0 of the vlt CLI so that we can properly manage these skills that are already being shipped in packages.
2
3
7
546
Darcy Clarke retweeted
in the next version of Porffor, Test262 compliance leaps to 96%! this marks a milestone where Node compat and performance finally become major blockers
ALT "porffor passes 96.05% of test262" with a graph showing progress over time
14
16
260
10,224
Darcy Clarke retweeted
🎥 The NodeConf EU 2026 talks are now online!
Missed a talk or want to revisit something that caught your attention? Now’s your chance!
All the talks are available on our YouTube channel piped.video/@nodeconfeu
#NodeConfEU #NodeJS #TechCommunity
7
11
1,102
Darcy Clarke retweeted
🚀 vlt@1.4.0 is out with faster installs for macos and a new `--save-types` option to automatically add type dependencies.
1
2
5
280
Darcy Clarke retweeted
The #vlt client now has an 'outdated' command!
Read all about it: vlt.io/blog/vlt-outdated
What do you want from an 'outdated' command?
1
3
333
Darcy Clarke retweeted
hyperfine 2.0 is out now! It includes support for alternative performance metrics like peak memory usage, CPU cycles, and more.
15
38
527
20,415
Your package manager is faster with vlt.io - I think it's time to break up with npm.
on a next app and an express api we're seeing clean installs take 20%-70% less time without changing package managers
2
9
661
Darcy Clarke retweeted
on the ⚡️@vltpkg ⚡️registry we serve metadata that is 70% smaller which is one reason (out of many!) that we're able to do clean installs in 20-70% less time when you point to our registry vs npmjs․org. i wrote about how we did it: vlt.io/blog/registry-metadat…
1
4
9
368
Darcy Clarke retweeted
Providers have idle compute. Buyers pay list price.
We built a market for compute — bill by the second, minute, hour, or day.
Sign up for early access is open.
10
3
35
3,826
Darcy Clarke retweeted
Added vlt to upm benchmarks also it got faster thanks to the findings from vlt.sh bench suite 🫡
📦 upm 1.3:
- Faster
- Better hoisting
- Consumes less resources on large repos
- Minimal CLI progress bar + an onProgress API
- Matches native-scores in independent @vltpkg benchmarks* (3.4ms/pkg => 2ms/pkg on average)
*Benchmark results vary by hardware and scenario. upm is by far the smallest.
2
6
369
Darcy Clarke retweeted
Shoutout to all #NodeConfEU 2026 #Sponsors and #Friends!
Thank you! 💛 Your partnership is helping us create something truly special in the #Node.js #community!
Our Sponsors 🙏
@Cloudflare @platformatic @SocketSecurity @nxtedition @ZephyrCloudIO @tether
1
7
12
1,022