registry-lockfile
A lockfile install, holding the package manager constant and varying the registry.
Loading…
Cites this run by its date, with a link back here.
registry-lockfile
registry.vlt.io is fastest at 10.8s, 1.03× faster than registry.npmjs.org.A lockfile install, holding the package manager constant and varying the registry.
Mean install time across 6 fixtures in the registry-lockfile scenario, from the run of Oct 20, 2026 on GitHub-hosted ubuntu-24.04-arm runners. Every registry is installed from with the same npm client.
Disclosure. vlt publishes this benchmark, and registry.vlt.io is one of the registries it measures. The suite, its configuration and every result file are public.
| 1 | registry.vlt.io | 10.8s±2.4% | 1.03× faster | −0.6% | ||
| 2 | registry.npmjs.org | 11.1s±0.6% | baseline | +0.6% | ||
| 3 | JFrog Artifactory | 12.5s±1.0% | 1.12× slower | +2.7% | ||
| 4 | GitHub Packages | 13.0s±1.5% | 1.17× slower | +2.4% | ||
| 5 | AWS CodeArtifact | 15.3s±1.5% | 1.38× slower | +11.2% | ||
| 6 | Cloudsmith | 64.8s±49.4% | 5.8× slower | +16.5% |
Lower is faster. ± is the pooled relative standard deviation. Since last run compares with Oct 19, 2026.
10.8s
11.1s
12.5s
13.0s
15.3s
64.8s
Lower is faster. Bars start at zero, each a bright cap on its tool's colour, labelled with its time and its multiple of the baseline. Dashed outline and dashed rule: the baseline, registry.npmjs.org.
Lower is faster; bars start at zero, each a bright cap on its tool's colour. All fixtures: a group per fixture, the tools in leaderboard order, as in the legend; hover a fixture to read each by name. Each fixture: its tools fastest first, each labelled with its time. A tool is drawn on every fixture it finished; a failed run is named, not drawn. The legend shows and hides tools everywhere on the page. Dashed outline and dashed rule: the baseline, registry.npmjs.org.
| registry.vlt.io | 4.05s1.02× faster | 35.2s1.01× slower | 13.2s1.13× faster | 7.28s1.01× faster | 692ms1.09× faster | 4.49s1.04× faster |
| registry.npmjs.org | 4.12sbaseline | 34.9sbaseline | 15.0sbaseline | 7.36sbaseline | 752msbaseline | 4.67sbaseline |
| JFrog Artifactory | 4.50s1.09× slower | 37.1s1.06× slower | 19.6s1.31× slower | 7.46s1.01× slower | 1.01s1.35× slower | 5.21s1.12× slower |
| GitHub Packages | 4.39s1.06× slower | 36.6s1.05× slower | 23.4s1.56× slower | 7.54s1.02× slower | 924ms1.23× slower | 5.07s1.09× slower |
| AWS CodeArtifact | 4.05s1.02× faster | 36.9s1.06× slower | 37.5s2.5× slower | 7.42s1.01× slower | 1.21s1.61× slower | 4.87s1.04× slower |
| Cloudsmith | 4.47s1.08× slower | 298s8.5× slower | 72.6s4.8× slower | 7.51s1.02× slower | 766ms1.02× slower | 5.03s1.08× slower |
Each cell is the mean time, with its multiple of registry.npmjs.org on that fixture beneath. Bold: fastest on the fixture. DNF: the run exited non-zero and is excluded from every figure. A dash: not run on that fixture.
Milliseconds per installed package; lower is faster. Tools disagree about what a dependency graph contains, so a tool that installs fewer packages finishes sooner without being faster — this is the figure that corrects for it. Dashed outline and dashed rule: the baseline, registry.npmjs.org.
| registry.vlt.io | 14.5ms1.02× faster | 19.5ms1.00× slower | 9.1ms1.13× faster | 21.7ms1.01× faster | 11.9ms1.09× faster | 10.0ms1.04× faster |
| registry.npmjs.org | 14.8msbaseline | 19.5msbaseline | 10.3msbaseline | 22.0msbaseline | 13.0msbaseline | 10.4msbaseline |
| JFrog Artifactory | 16.1ms1.09× slower | 20.6ms1.06× slower | 13.5ms1.31× slower | 22.3ms1.01× slower | 17.5ms1.35× slower | 11.7ms1.12× slower |
| GitHub Packages | 15.7ms1.06× slower | 20.4ms1.04× slower | 16.1ms1.56× slower | 22.5ms1.02× slower | 15.9ms1.23× slower | 11.4ms1.09× slower |
| AWS CodeArtifact | 14.5ms1.02× faster | 20.5ms1.05× slower | 25.8ms2.5× slower | 22.1ms1.01× slower | 20.9ms1.61× slower | 10.9ms1.04× slower |
| Cloudsmith | 16.0ms1.08× slower | 166ms8.5× slower | 49.9ms4.8× slower | 22.4ms1.02× slower | 13.2ms1.02× slower | 11.2ms1.07× slower |
Bold: fastest on the fixture. A tool with a time but no published package count is left out rather than divided by a guess.
| registry.npmjs.org | 279 | 1,791 | 1,454 | 335 | 58 | 447 | 4,364 |
| AWS CodeArtifact | 279 | 1,798 | 1,454 | 335 | 58 | 447 | 4,371 |
| GitHub Packages | 279 | 1,799 | 1,454 | 335 | 58 | 447 | 4,372 |
| JFrog Artifactory | 279 | 1,799 | 1,454 | 335 | 58 | 447 | 4,372 |
| registry.vlt.io | 279 | 1,801 | 1,454 | 335 | 58 | 447 | 4,374 |
| Cloudsmith | 279 | 1,802 | 1,455 | 336 | 58 | 450 | 4,380 |
A range beneath a count means that tool's installs did not all produce the same number of packages.