Freedom251 › JavaScript Package Managers

Aube

Free plan LinuxMacWindows

What Aube is

Aube is an open-source Node.js package manager written in Rust for Linux, macOS, and Windows. Its aubr command checks for missing or stale dependencies before running a project script. It reads and writes pnpm, npm, Yarn, and Bun lockfiles, and uses a content-addressable store to share package directory trees across projects and worktrees. For one-off tools, aubx uses a local binary if available or installs the tool in a temporary project. Workspaces, filters, and catalogs are supported through pnpm-workspace.yaml or aube-workspace.yaml, and commands can use a project-pinned Node version. During version selection, Aube checks publishing evidence, release age, and known malicious packages. Dependency lifecycle scripts require project approval or built-in trust, with explicit denials taking precedence. When integrity verification is enabled, fetched registry tarballs are checked against recorded values. The project also documents embedding integrations and a GitHub Action. Installation options include mise, Homebrew, npm, Cargo, distribution packages, and source builds. Yarn Plug'n'Play projects are not supported and need a node_modules linker.

Who it suits

Aube suits Node.js developers who want dependency checks when running scripts, workspace support, and shared package storage. It may also suit teams that want documented checks around package versions and lifecycle scripts.

What it does well

Supports pnpm, npm, Yarn, and Bun lockfiles.
Shares package trees across projects and worktrees.
Supports workspaces, filters, and catalogs.
Version selection checks for known malicious packages.
Available for Linux, macOS, and Windows.

What to know first

Yarn Plug'n'Play projects are not supported.
Existing projects may need lockfile review and tests when switching.
Optional build jail is off by default.

Limits

Yarn Plug'n'Play projects are unsupported and require a `node_modules` linker. The optional build jail is off by default; on macOS and Linux, its documented restrictions cover native writes and network access, while filesystem reads remain unrestricted.

Getting started

Choose an installation route: mise, Homebrew, npm, Cargo, an Ubuntu PPA, Fedora COPR, or a source build.
Install Aube for your operating system.
Use `aubr` to run a project script with missing or stale dependencies installed first.
For a one-off tool, use `aubx` to run a local binary or install it in a throwaway project.
If migrating an existing project, review the lockfile diff and run its tests.

Verdict

Aube combines package management with workspace features and security checks. Its unsupported Yarn Plug'n'Play layout and potential migration adjustments are worth checking before switching.

Questions

Is Aube free?

Yes. Aube is free and open source under the MIT License.

Which operating systems does Aube support?

Aube is available for Linux, macOS, and Windows. Installation options vary by platform and distribution.

Which lockfiles does Aube support?

It reads and writes supported pnpm, npm, Yarn, and Bun lockfiles in place.

Does Aube support workspaces?

Yes. It supports workspace packages, filters, and catalogs through `pnpm-workspace.yaml` or `aube-workspace.yaml`.

Does Aube support Yarn Plug'n'Play?

No. Yarn Plug'n'Play projects need a `node_modules` linker.

How can I get help with Aube?

The project directs bug reports to GitHub Issues, questions to GitHub Discussions, and conversation to Discord.

Facts from Aube's own pages

Automatic installs: The aubr command installs missing or stale dependencies before running a project script. · aube.sh, 1 Oct 2026
Build jail limits: The optional build jail is off by default; the maker documents native write and network restrictions on macOS and Linux, while filesystem reads remain unrestricted. · aube.sh, 2 Oct 2026
Build permissions: Dependency lifecycle scripts require project approval or built-in trust, and explicit denies take precedence. · aube.sh, 1 Oct 2026
CI integration: The maker points to the jdx/aube-action GitHub Action for installing the native binary and optionally Node.js. · aube.sh, 2 Oct 2026
Compatibility limit: Yarn Plug'n'Play projects are not supported and require a node_modules linker. · github.com, 1 Oct 2026
Dependency build controls: Dependency lifecycle scripts require project approval or built-in trust, and explicit denies take precedence. · aube.sh, 2 Oct 2026
Install options: The maker documents installation through mise, Homebrew, npm, Cargo, Ubuntu PPA, Fedora COPR, and source builds. · aube.sh, 2 Oct 2026
Integrations: Aube provides embedding integrations for Rust, Node-API hosts, and C ABI consumers. · aube.sh, 1 Oct 2026
Integrity: With integrity verification enabled, Aube checks fetched registry tarballs against recorded integrity values and fails on mismatches. · aube.sh, 1 Oct 2026
License: The site identifies aube as MIT licensed. · aube.sh, 2 Oct 2026
Lockfiles: aube reads and writes supported pnpm, npm, Yarn, and Bun lockfiles in place. · aube.sh, 2 Oct 2026
Migration caveat: The maker says aube's isolated dependency layout and security defaults can expose assumptions in existing projects and recommends reviewing the lockfile diff and running tests before switching. · aube.sh, 2 Oct 2026
Node runtimes: Commands can use a project-pinned Node version from devEngines.runtime, .node-version, or .nvmrc. · github.com, 1 Oct 2026
One-off tools: The aubx command uses a matching local binary when available or installs the requested tool in a throwaway project. · aube.sh, 2 Oct 2026
Platform support: The installation page lists Homebrew for macOS or Linux and packages for supported Ubuntu and Fedora/RHEL distributions; the security page also describes Windows behavior for jailed scripts. · aube.sh, 2 Oct 2026
Product: aube is a Node.js package manager that works with supported npm, pnpm, Yarn, and Bun lockfiles and shares installed packages across projects. · aube.sh, 2 Oct 2026
Run scripts: The aubr command checks for missing or stale dependencies before running a project script. · aube.sh, 2 Oct 2026
Security checks: The documented defaults include a 24-hour minimum release age and checks for known malicious packages during fresh resolution. · aube.sh, 2 Oct 2026
Security defaults: Aube checks publishing evidence, release age, and known malicious packages during version selection. · aube.sh, 1 Oct 2026
Shared storage: Its content-addressable store and global virtual store share package files and directory trees across local projects and worktrees. · aube.sh, 2 Oct 2026
Support: The project directs users to GitHub Issues for bugs, GitHub Discussions for questions, and Discord for conversation. · aube.sh, 1 Oct 2026
Workspaces: Aube supports workspace packages, filters, and catalogs through pnpm-workspace.yaml or aube-workspace.yaml. · github.com, 1 Oct 2026

Where Aube stands on Freedom251

JavaScript Package Managers#4 of 19