Post
nub install β a fast, secure, incrementally adoptable package manager π 2.7x faster than pnpm (warm install) π§© pnpm-compatible CLI (muscle memory) π powered by the Aube engine (by @jdx.dev)
It takes the safest default security posture of any package manager in the ecosystem π 24hr minReleaseAge π checks OSV for known vulns during resolution (never installs known-bad pkgs) π blocks postinstall by default π blocks trust downgrades (e.g. recent versions that lost npm provenance)
0 reposts4 likes
Good starting point. There's more to do in security configuration. Consider outsourcing that part to www.npmjs.com/package/@lav... when I release 1.0 We should chat about the integration point. In npm and pnpm I'm plugging into script running for some added security (more coming down the pipeline)
Nub detects your existing package manager (via package.json or lockfile) and runs in COMPAT MODE π reads *and writes* your existing lockfile (roundtrip!) βοΈ respects your config files (see chart) β‘οΈ zero config changes required in 99% of cases (Nub aborts when unsupported config is detected)
Nub is now in public beta. Lots more on the roadmap, stay tuned! Star/watch the repo! π github.com/nubjs/nub