Nub

Nub is a fast, all-in-one toolkit for Node.js written in Rust, published under the MIT license. It runs TypeScript files, executes package.json scripts, installs dependencies, and manages Node versions — all from a single binary that augments stock Node rather than replacing it. The project was created in June 2026 and reached v0.2.1 within weeks of launch.

What It Is

Nub is a CLI toolchain that sits on top of the Node.js you already have. Instead of introducing a new JavaScript runtime, it uses Node's own public extension surfaces — module.registerHooks(), --import preloads, and N-API native addons — to add TypeScript/JSX support, faster script dispatch, and supply-chain-hardened package management. The result is described by the project as "a Bun-like DX on top of stock node, written in Rust."

The toolkit covers five distinct jobs:

• File runner (nub <file>) — runs .ts, .tsx, .jsx, and standard JS files on stock Node with full TypeScript support via the oxc transpiler compiled into a native Node addon
• Script runner (nub run) — a drop-in for npm run / pnpm run, benchmarked by the project at ~24× faster than pnpm run on warm dispatch
• Bin runner (nubx) — a drop-in for npx / pnpm exec, benchmarked at ~19× faster than npx for local bin invocation
• Package manager (nub install) — pnpm-compatible CLI powered by the aube Rust resolver, benchmarked at ~2.5× faster than pnpm on warm frozen installs
• Node version manager (nub node) — reads .node-version, .nvmrc, or package.json#engines and auto-provisions the correct Node version from nodejs.org

How It Augments Node Without Replacing It

Nub's core design principle is zero lock-in. There is no Nub global, no nub:* module namespace, no @nub/* npm scope, and no Nub-specific lockfile. Code transpiled by Nub runs on the real node binary. The project publishes a compatibility table showing Nub passing 98.8% of Deno's Node-compat corpus (4,315 / 4,368 tests), compared to Deno at 77.4% and Bun at 40.5%, with the small gap attributed to auto-enabling experimental features and loading native addons.

TypeScript support goes beyond Node's built-in type stripping: Nub handles enums, parameter properties, extensionless imports, tsconfig.json path aliases, decorators, emitDecoratorMetadata, JSX, and the using / await using explicit resource management syntax. It also auto-loads .env, .env.local, and .env.[NODE_ENV] files with variable expansion, matching Next.js and Vite behavior.

Supply-Chain Security Model

The package manager ships with several hardened defaults that are off by default in npm and pnpm:

• Deny-by-default build scripts — postinstall scripts are skipped unless explicitly approved via nub approve-builds
• OSV advisory checks — queries osv.dev for known-malicious package versions on every fresh resolve
• Provenance downgrade protection — refuses a version whose publish trust evidence weakened compared to an earlier release
• 24-hour minimumReleaseAge — holds back freshly-published versions, matching pnpm's default

Compatibility and Integration

Nub's package manager detects the incumbent package manager from package.json#packageManager or existing lockfiles and operates in compat-mode: it reads and writes package-lock.json, pnpm-lock.yaml, and bun.lock in place, with yarn lockfiles supported as read-only. The script runner implements pnpm's full --filter grammar including graph selectors (...@org/web) and changed-since selectors ([main]). A GitHub Action (nubjs/setup-nub) is a one-to-one drop-in for actions/setup-node. An official Docker base image (ghcr.io/nubjs/nub) is also provided.

Update: v0.2.1

The latest release is v0.2.1, published on June 25, 2026, roughly three weeks after the repository was created on June 3, 2026. The project accumulated over 2,000 GitHub stars in that window. The repository is actively maintained with 8 open issues and regular pushes. The project direction is toward a comprehensive Node.js toolchain replacement for tsx, ts-node, nvm, fnm, npx, and pnpm — without requiring users to abandon their existing runtime or lockfile format.