Aube
What it is
Aube is a free, open-source Node.js package manager written in Rust for Linux, macOS, and Windows. The aubr command checks for missing or stale dependencies before running a project script. Aube reads and writes pnpm, npm, Yarn, and Bun lockfiles, while a content-addressable store shares package directory trees across projects and worktrees. The aubx command uses a local binary when available or installs a tool in a temporary project. Workspace packages, filters, and catalogs work through pnpm-workspace.yaml or aube-workspace.yaml. Commands can use a project-pinned Node version from supported version files. Security checks consider publishing evidence, release age, and known malicious packages; documented defaults include a 24-hour minimum release age. Lifecycle scripts require approval or built-in trust, and explicit denials take priority. Optional integrity verification checks registry tarballs against recorded values. Aube supports Rust, Node-API, and C ABI embedding and offers a GitHub Action. Installation options include mise, Homebrew, npm, Cargo, distribution packages, and source builds.
For and against
For
- Open-source and free under the MIT License
- Supports pnpm, npm, Yarn, and Bun lockfiles
- Workspace packages, filters, and catalogs
- Security checks during version selection
- Shared package trees across projects
Against
- Yarn Plug'n'Play projects are unsupported
- Optional build jail is off by default
- Existing projects may need migration review
The verdict
Aube offers a Rust-based package workflow with workspace features, multiple lockfiles, and security controls. Teams using Yarn Plug'n'Play or assumptions about dependency layouts should account for its compatibility limits.
Who it suits
Aube suits Node.js developers who want workspace support, lockfile compatibility, shared storage, and security checks. It is available across Linux, macOS, and Windows.
On the record
- Automatic installs
- The aubr command installs missing or stale dependencies before running a project script.aube.sh · read 1 Oct 2026
- Build jail limits
- The optional build jail is off by default; the maker documents native write and network restrictions on macOS and Linux, while filesystem reads remain unrestricted.aube.sh · read 2 Oct 2026
- Build permissions
- Dependency lifecycle scripts require project approval or built-in trust, and explicit denies take precedence.aube.sh · read 1 Oct 2026
- CI integration
- The maker points to the jdx/aube-action GitHub Action for installing the native binary and optionally Node.js.aube.sh · read 2 Oct 2026
- Compatibility limit
- Yarn Plug'n'Play projects are not supported and require a node_modules linker.github.com · read 1 Oct 2026
- Dependency build controls
- Dependency lifecycle scripts require project approval or built-in trust, and explicit denies take precedence.aube.sh · read 2 Oct 2026
- Install options
- The maker documents installation through mise, Homebrew, npm, Cargo, Ubuntu PPA, Fedora COPR, and source builds.aube.sh · read 2 Oct 2026
- Integrations
- Aube provides embedding integrations for Rust, Node-API hosts, and C ABI consumers.aube.sh · read 1 Oct 2026
- Integrity
- With integrity verification enabled, Aube checks fetched registry tarballs against recorded integrity values and fails on mismatches.aube.sh · read 1 Oct 2026
- License
- The site identifies aube as MIT licensed.aube.sh · read 2 Oct 2026
- Lockfiles
- aube reads and writes supported pnpm, npm, Yarn, and Bun lockfiles in place.aube.sh · read 2 Oct 2026
- Migration caveat
- The maker says aube's isolated dependency layout and security defaults can expose assumptions in existing projects and recommends reviewing the lockfile diff and running tests before switching.aube.sh · read 2 Oct 2026
- Node runtimes
- Commands can use a project-pinned Node version from devEngines.runtime, .node-version, or .nvmrc.github.com · read 1 Oct 2026
- One-off tools
- The aubx command uses a matching local binary when available or installs the requested tool in a throwaway project.aube.sh · read 2 Oct 2026
- Platform support
- The installation page lists Homebrew for macOS or Linux and packages for supported Ubuntu and Fedora/RHEL distributions; the security page also describes Windows behavior for jailed scripts.aube.sh · read 2 Oct 2026
- Product
- aube is a Node.js package manager that works with supported npm, pnpm, Yarn, and Bun lockfiles and shares installed packages across projects.aube.sh · read 2 Oct 2026
- Run scripts
- The aubr command checks for missing or stale dependencies before running a project script.aube.sh · read 2 Oct 2026
- Security checks
- The documented defaults include a 24-hour minimum release age and checks for known malicious packages during fresh resolution.aube.sh · read 2 Oct 2026
