aube is a package manager for Node.js projects. It uses pnpm-style isolated node_modules for fast, disk-efficient installs.
Existing projects keep their lockfile format. aube reads and writes pnpm-lock.yaml, package-lock.json, npm-shrinkwrap.json, yarn.lock, and bun.lock in place. New projects without a supported lockfile get aube-lock.yaml.
Why Try It
Fast installs. Warm installs are about 8x faster than pnpm and about 5x faster than Bun in the current benchmarks. Repeat test commands run up to 35x faster than pnpm and up to 5x faster than Bun.
Existing lockfiles. Reads and writes pnpm-lock.yaml, package-lock.json, npm-shrinkwrap.json, yarn.lock, and bun.lock in place.
Cheap repeat commands. aubr test, aube test, and aube exec vitest auto-install when dependencies are stale, then skip that work when nothing changed. aubx uses a local binary when one is installed, or a throwaway environment for one-off tools.
Less disk use. A global content-addressable store lets projects share package files instead of keeping a full copy of the same dependencies in every checkout.
Secure defaults. Out of the box, exotic transitive deps are blocked, lifecycle scripts wait for approval, trust downgrades fail at resolve, and brand-new releases sit in a 24h cooling window. One paranoid: true line adds the build jail and turns the soft gates into hard fails.
What's new in 2.8.3
Fixed - NPM_CONFIG_GLOBALCONFIG is now read (#1818, @jdx): before this fix, if the internal registry was set only through NPM_CONFIG_GLOBALCONFIG, with no ~/.npmrc or NPM_CONFIG_USERCONFIG, aube ignored it and fetched packages from registry.npmjs.org. aube now reads the file that NPM_CONFIG_GLOBALCONFIG or npm_config_globalconfig points to, including registry, scoped registry and auth token settings. - As in npm, the global file has the lowest precedence. Project .npmrc overrides user config, and user config overrides the global file. npm_config_* environment variables override all of them. - If both casings are set, the upper-case variable wins. A leading ~ in the path is expanded. - aube reads the global file only when one of these variables is set. It does not look in npm's default $PREFIX/etc/npmrc location. # file pointed to by $NPM_CONFIG_GLOBALCONFIG registry=<your internal registry URL> //<your registry host>/:_authToken=...
