There's a NEW Package Manager!? (Bun Alternative)

BBetter Stack
Computing/SoftwareInternet Technology

Transcript

00:00:00This is Nub, an all-in-one JavaScript toolkit that works on top of Node instead of replacing it.
00:00:04It replaces all of these tools that you're currently using, from the package manager which
00:00:08is five times faster than PMPM, to the TypeScript runner that can replace TSX,
00:00:13and even a Node version manager. It is Bun's best features but on top of stock Node.js,
00:00:17and that's probably the reason why Nub is just Bun spelled backwards.
00:00:21And I know JavaScript devs love to reinvent things, but this isn't just some random person's
00:00:25project. It's actually made by Colin, who is the creator of Zod, and he made the proof of
00:00:29concept for TRPC, and it even worked at Bun. So let's just dive in and take a look.
00:00:38So Nub is one Rust binary, and it works with Mac, Windows, and Linux, and as I showed in the intro,
00:00:44these are just some of the tools that it can replace. It's a file runner, a script runner,
00:00:47package runner, package manager, and a Node version manager. So let's go through each of these.
00:00:52First up, the file runner, and this alone has so many features. The file runner supports full
00:00:56TypeScript, not just type stripping like Node would do, so it can replace a tool like TSX or TSNode.
00:01:02And we can see here I have a TypeScript file that has enums in it, namespaces, as well as param
00:01:06properties, and that isn't something that Node can normally run. If I simply run Nub, and then the
00:01:11file that I want to run, you can see that it runs perfectly fine, where it would fail on Node.
00:01:15So if I replaced Nub here with Node, we can see that we get error unsupported TypeScript syntax,
00:01:20as it doesn't like the namespace or the enum. The file runner can also replace tools like .env,
00:01:24importing the environment variables automatically. It supports .env files, .env local, and also the
00:01:29Node environment ones, and even has automatic variable expansion. So down here we can have a
00:01:33variable which is made up of other environment variables. So we have the database user and the
00:01:37database host here. If I now run this file with Nub, you can see it imports those environment
00:01:41variables for me, and it's made up my health check URL using the other environment variable values.
00:01:46You can also see that my API key doesn't actually match the one that I have in the .env here.
00:01:50That's because .env local is always going to take precedence, and in here I have the API key
00:01:54set to subscribe to better stack. That is something you should definitely do if you want to stay up
00:01:58to date with AI and developer news. Please subscribe, it really helps out. Next I'm going to go ahead
00:02:02and run nub and then source slash index.tsx, and we can see that everything is working here. It's
00:02:07my nub kitchen sink. In the code for that file, I'm using tons of features that nub file runner gives us.
00:02:12One of the first ones is that we can import JSON files, as well as YAML,
00:02:15HTML, and even text files, and it can also replace a tool like tsconfig paths. So the paths I've set up
00:02:20here with atconfig, where I've set this up in my tsconfig, it's going to go ahead and make sure these
00:02:24are resolved by Node properly. It also has support for decorators, like service and sealed here. It has
00:02:29JSX support, and it'll actually transpile this based on your tsconfig settings, and you can even use
00:02:34modern keywords like the using keyword for explicit resource management. In addition to all of that,
00:02:38it also has support for tons of modern APIs, like web workers, temporal, and loads of others. It will polyfill
00:02:43them automatically for you on Node versions that don't support them, and it also unflags experimental
00:02:48Node features like local storage support. That's just scratching the surface of all of the features
00:02:52that the file runner supports, but I also want to mention that it's flag for flag compatible with
00:02:56Node. I mean, since it's just running Node in the end, it just forwards those flags. That means if your
00:03:01script isn't using any features that Node doesn't support, you can just switch nub for Node and get the
00:03:06exact same result. All of this is done, by the way, with nearly zero overhead in speed. It should be as
00:03:10close to Node as possible, and according to their documentation, it takes the exact same amount of
00:03:14time to run a nub file as it does in Node. I will admit this won't be faster than Bun, since Bun is
00:03:19a native runtime that replaces Node, and nub is just built on top of Node. I actually decided to run my
00:03:24own benchmark on my Mac here to see which one is quicker, and if I just make these look a little
00:03:28bit nicer, we can see that Node was actually the quickest for me. It wasn't the exact same speed
00:03:31as nub. Nub was a little bit behind, but then TSX was slower than both of them. Moving away from the
00:03:36file runner though, feature number two is the Node version manager. Gone are the days of needing NVM or
00:03:41FNM. In nub, if I have a file in my project called Node version, or if I define it in the nvmrc or even
00:03:46in the package.json, nub is going to automatically install the required version for me from Node.js.
00:03:52At the moment this project is using the latest Node 26 version, if I change this file to say something
00:03:56like 24, and I rerun it using nub, it will automatically grab that Node version for me. It also has all of the
00:04:02usual management commands that you'd expect, so we can install Node versions, we can list the installed
00:04:06ones, we can uninstall Node versions, and there's even version pinning which will write that Node
00:04:10version file for you. It really is as simple as that, so let's move on to our next three features,
00:04:15which is where nub can replace pnpm and bun. First is feature number three, which is just the
00:04:20package manager. This is promising to be five times faster than pnpm, and I thought pnpm was already
00:04:25super fast. This works as you'd expect it to, nub install installs the packages, but something quite cool
00:04:31here is it can actually adopt your existing lock files, so if you've used bun or pnpm in a project
00:04:36before, nub will just update those lock files instead of having one of its own. This makes it super easy
00:04:41to switch between them if you ever needed to, and the same goes for the pnpm compatibility. Every package
00:04:46management command in nub is the exact same as pnpm, including pnpm's advanced features like
00:04:51workspace catalogs. It's the exact same flag, so swapping pnpm and nub should just work, and if you're
00:04:57using npm, bun or yarn, the configuration options of those package managers should be picked up as well.
00:05:02When it comes to that claim about speed, that benchmark's placed nub as the fastest at warm
00:05:06frozen installs, taking 346 milliseconds to install 1168 packages, and on my machine I actually did a
00:05:13test of 14 direct dependencies that resolve to 212 unique packages, and the benchmark proves that nub is
00:05:19the fastest. Nub installed my packages in 136 milliseconds, bun was second at 239 milliseconds,
00:05:25and pnpm and npm actually took over a second, so that speed claim seems to be true on my machine,
00:05:30with some seriously impressive speeds. The package manager also takes the best bits of pnpm when it
00:05:35comes to security, it has a minimum release age default of 24 hours, and it won't run build scripts
00:05:40unless approved, so you should be safe from most shy hallood attacks. The next great part of a package
00:05:45manager is the actual package running, which is feature number 4, and the headline here is that
00:05:49it's 19 times faster than npx. The nub x command actually resolves to the binary folder within node
00:05:54modules, so in Rust it actually executes the binaries directly, so there's no node process in
00:05:59the wrapper, which also means that it works with any package manager since it's just going direct to
00:06:03those node modules. As with most of the nub commands, it's actually flag for flag compatible with
00:06:07pnpm exec, including the dlx commands as well. Running a benchmark on my Mac, nub was actually the
00:06:12quickest at 169ms to run an ES build, versus pnpm of 423ms, so again it seems our speed claim has some
00:06:20truth to it. The final feature you need in a package manager is the script runner, and apparently this
00:06:24one is 24 times faster than pnpm run, and it has lifecycle hooks, npm environment variables,
00:06:29and argument forwarding. When you use npm or pnpm, these actually launch node.js programs,
00:06:34loading each package manager's javascript each time, whereas nub just uses its Rust binary
00:06:38with no startup processes. My local benchmarks again showed that nub run was actually the quickest,
00:06:43but not by as large as a margin as we saw on that documentation. It's also worth noting,
00:06:47and it's the fourth time I'm saying this in this video, this command is flag for flag compatible
00:06:51with pnpm, meaning it also supports pnpm's mono repo features. One thing I actually want to shout
00:06:56out for those last three features is that nub didn't reinvent the wheel. It actually uses
00:07:00OBE under the hood, which is a package manager written by JDX, who's also the creator of
00:07:04Mee's. He actually made the package manager embeddable by other libraries, and Colin worked
00:07:08with him to use it in nub, so it's not just stolen work. Those are the main headline features
00:07:13of nub then, but there is still so much more to explore, such as the drop-in replacement GitHub
00:07:17action, which replaces the official setup node one. It really has just been made to make everything
00:07:21around node much easier. But here's the question I'm left asking myself, would I actually use
00:07:26this? For me, my answer is yes in certain scenarios. I'll be honest, I'm a pretty heavy
00:07:31bun user, and I've not run into any compatibility issues in my development. Maybe with the new
00:07:35Rust port, I might move away, but even then I would use pnpm for everything else, and I
00:07:40must admit, I've never noticed that pnpm is too slow. I also use Mee's to manage my node
00:07:44version, so I don't see myself needing that side of things, but I can see myself wanting
00:07:48the file runner that replaces TSX. The ultimate use case that I see for myself, though, is when
00:07:52I use new throwaway virtual machines. Sometimes I spin these up really quickly to do some
00:07:57testing, and if I just want to get started with node, I think nub is one of the most complete
00:08:01packages, and the quickest and easiest way to do so. So it's mostly just me being stuck
00:08:05in my ways that's stopping me from using nub daily, but I do want to know what you use
00:08:08for your package manager, and if you do something like nub, maybe you're looking to switch from
00:08:12bun now that it's rewritten in Rust. Let me know in the comments down below, or if they're
00:08:16subscribed, and as always, see you in the next one.

Key Takeaway

Nub provides an all-in-one Rust binary for Node.js environments that unifies version management, native TypeScript execution, and package management, completing local dependency installs in 136 milliseconds while maintaining compatibility with Node and pnpm flags.

Highlights

  • Nub is an all-in-one JavaScript toolkit shipped as a single Rust binary that operates on top of Node.js rather than replacing it.

  • Created by Colin, creator of Zod, Nub includes a file runner, script runner, package runner, package manager, and Node version manager.

  • The package manager installs packages faster than Bun, pnpm, and npm, completing a test of 14 direct dependencies (212 unique packages) in 136 milliseconds.

  • The file runner executes TypeScript files natively—including namespaces, enums, and parameter properties—without relying on type stripping or tools like TSX.

  • Built-in security defaults include a 24-hour minimum release age for packages and blocked build script execution unless manually approved.

Timeline

Overview of Nub and Core Architecture

  • Nub serves as an all-in-one JavaScript toolkit built directly on top of stock Node.js.
  • The tool ships as a single Rust binary compatible with macOS, Windows, and Linux.
  • Colin, creator of Zod and early contributor to tRPC and Bun, developed Nub.

Rather than acting as a replacement runtime like Bun, Nub augments Node.js using a single Rust binary across platforms. It replaces multiple developer dependencies simultaneously by combining a file runner, script runner, package runner, package manager, and Node version manager into one CLI wrapper.

File Runner Capabilities and TypeScript Compatibility

  • Full TypeScript parsing enables execution of features like namespaces, enums, parameter properties, decorators, and the using keyword.
  • Environment variables load automatically from .env, .env.local, and Node environment files with support for variable expansion.
  • Performance benchmarks show Nub running files slightly behind native Node but faster than TSX.

Unlike native Node's basic type-stripping, Nub's file runner transpiles advanced TypeScript constructs like namespaces and parameter properties directly. It handles module resolution paths defined in tsconfig, transpiles JSX, imports non-JS assets like JSON and YAML, auto-polyfills Web Workers or Temporal APIs, and unflags experimental Node features without added runtime overhead.

Built-in Node Version Management

  • Version requirements declared in .node-version, .nvmrc, or package.json trigger automatic Node.js version installations.
  • Standard version management features include listing, installing, uninstalling, and pinning specific Node releases.

Nub removes the need for standalone tools like NVM or FNM by reading local project configuration files directly. Changing the specified Node version instantly prompts Nub to fetch and switch to the targeted release upon executing subsequent commands.

Package Manager Benchmarks and Security Controls

  • Package management commands adopt existing lockfiles and match pnpm syntax and workspace catalog features.
  • Local dependency installation benchmarks clocked Nub at 136ms, compared to Bun at 239ms and pnpm/npm at over 1,000ms.
  • Default security configurations mandate a minimum release age of 24 hours and block unapproved build scripts.

Nub operates directly on top of existing lockfiles from pnpm, Bun, or npm, making it plug-and-play without introducing proprietary file structures. Safety features target supply chain vulnerabilities by halting arbitrary post-install scripts until explicitly authorized by the developer.

Package Execution, Script Running, and Underlying Engine

  • The nubx command executes node_modules binaries directly through Rust without initializing intermediate Node processes.
  • Script execution via nub run bypasses JS startup processes to execute faster than pnpm run.
  • Under the hood, Nub integrates the embeddable OBE package manager developed by JDX.

By bypassing Node.js process initialization for CLI scripts and package execution, Nub cuts overhead during recurring development tasks like running ESBuild or monorepo build scripts. It leverages the open-source OBE package manager core to deliver high-performance package handling within its Rust architecture.

GitHub Actions Integration and Development Scenarios

  • A drop-in GitHub Action replaces setup-node for CI/CD pipelines.
  • The toolkit provides an efficient setup method for fresh, temporary virtual machines.

While developers using dedicated runtimes like Bun or established tools like Mise may keep existing workflows, Nub streamlines environments requiring stock Node compatibility. It reduces initial configuration time when bootstrapping disposable virtual machines or configuring continuous integration runners.

Community Posts

View all posts