Freedom251 › JavaScript Package Managers

Rusk

Free plan LinuxMacWindows

What Rusk is

Rusk is a free package manager for JavaScript and Python that verifies package artifacts before installation. It works with npm and PyPI registries, custom index URLs, and Git dependencies. The tool can detect rusk.toml, package.json, pyproject.toml, and requirements.txt in existing projects without requiring a configuration file. During downloads it checks SHA-256 digests, while its lockfile records exact digests for transitive dependencies and can migrate lockfiles from npm, Yarn, and pnpm. Rusk verifies npm ECDSA signatures and PyPI PEP 740 attestations, and detects provenance changes during updates. Users can set signature and provenance requirements, audit packages, and inspect why a package was allowed or blocked. Build isolation uses environment scrubbing with process or container backends. Commands provide structured exit codes and JSON output for CI, and anomaly reports can be sent to Slack, PagerDuty, Datadog, or any JSON endpoint without blocking installs. Release binaries support Linux, macOS, and Windows on x86_64 and aarch64. The project is licensed under Apache-2.0.

Who it suits

Rusk suits JavaScript and Python projects, including mixed-language monorepos and CI pipelines. It is useful for teams that need digest pinning, signature policies, provenance checks, and machine-readable CI results.

What it does well

Checks SHA-256 package digests
Verifies npm and PyPI attestations
Migrates npm, Yarn, and pnpm lockfiles
Provides isolated build sandboxes
Supports structured JSON CI output

What to know first

Anomaly reports do not block installs
Building from source requires Rust 1.75 or later
Release availability varies by architecture and version

Limits

The facts do not state a usage quota or seat limit for the free plan. Building from source requires Rust 1.75 or later, and anomaly reports are informational rather than install-blocking.

Getting started

Open the Rusk GitHub repository
Install a release binary for Linux, macOS, or Windows
Install with Cargo or build from source using Rust 1.75 or later
Run Rusk in a project containing rusk.toml, package.json, pyproject.toml, or requirements.txt
Configure signature and provenance requirements if needed

Verdict

Rusk focuses package installation on digest, signature, provenance, and build controls across JavaScript and Python projects. Its lockfile migration and CI-oriented output can fit existing workflows, while anomaly alerts remain informational rather than blocking.

Questions

What does Rusk manage?

Rusk manages JavaScript and Python packages from npm, PyPI, custom index URLs, and Git dependencies.

Which operating systems support Rusk?

Rusk supports Linux, macOS, and Windows. Release binaries are listed for x86_64 and aarch64, with a Windows x64 binary listed for version 0.1.1.

Can Rusk use existing project files?

Yes. It auto-detects rusk.toml, package.json, pyproject.toml, and requirements.txt, and existing projects do not need a configuration file.

Does Rusk support lockfiles?

Yes. Its lockfile pins transitive dependencies with exact digests and can migrate lockfiles from npm, Yarn, and pnpm.

How can Rusk report security events?

Anomaly reports can be sent to Slack, PagerDuty, Datadog, or any endpoint accepting JSON. These reports do not block installs.

What license does Rusk use?

Rusk is licensed under Apache-2.0.

Facts from Rusk's own pages

Audience: The README describes Rusk as usable for JavaScript and Python projects, including mixed-language monorepos and CI pipelines. · github.com, 5 Oct 2026
Build isolation: Rusk includes a build sandbox with process and container backends and environment scrubbing. · github.com, 5 Oct 2026
CI and alerts: Rusk supports structured exit codes, JSON output, and anomaly reports sent to Slack, PagerDuty, Datadog, or any endpoint accepting JSON. · github.com, 4 Oct 2026
CI output: All commands support JSON output, and Rusk provides structured CI exit codes. · github.com, 5 Oct 2026
Distribution: The README gives GitHub release binaries, Cargo installation, and source build as installation options; building from source requires Rust 1.75 or later. · github.com, 5 Oct 2026
Download platforms: The README says release binaries are available for Linux, macOS, and Windows on x86_64 and aarch64; the releases page lists a Windows x64 binary for v0.1.1. · github.com, 4 Oct 2026
Existing projects: It auto-detects package.json, requirements.txt, and pyproject.toml, and the README says no configuration file is needed for existing projects. · github.com, 5 Oct 2026
Installation: The README gives installation options through release binaries, cargo install, or building from source with Rust 1.75 or later. · github.com, 4 Oct 2026
Install integrity: Rusk checks package SHA-256 digests during downloads and pins package digests in its lockfile. · github.com, 5 Oct 2026
Integrity checks: It verifies package SHA-256 digests and checks content-addressed cache integrity. · github.com, 4 Oct 2026
License: The project is licensed under Apache-2.0. · github.com, 4 Oct 2026
Lockfiles: Its lockfile pins transitive dependencies with exact digests and supports migration from npm, Yarn, and pnpm lockfiles. · github.com, 4 Oct 2026
Manifest support: Rusk auto-detects rusk.toml, package.json, pyproject.toml, and requirements.txt. · github.com, 4 Oct 2026
Migration and compatibility: The README says Rusk can migrate lockfiles from npm, Yarn, and pnpm and supports .npmrc authentication tokens with environment variable expansion. · github.com, 5 Oct 2026
Other package sources: The feature list includes custom index URLs, Git dependencies, and .npmrc authentication token support. · github.com, 4 Oct 2026
Package sources: Rusk supports npm and PyPI registries, custom index URLs, and Git dependencies. · github.com, 5 Oct 2026
Platforms: The README provides release binaries for Linux, macOS, and Windows on x86_64 and aarch64. · github.com, 5 Oct 2026
Policy controls: Users can configure signature and provenance requirements and use audit, verify, and explain commands to inspect package trust. · github.com, 5 Oct 2026
Product: Rusk is a package manager for JavaScript and Python that verifies artifacts before installation. · github.com, 4 Oct 2026
Project status: The repository describes Rusk as a working package manager for installing JavaScript and Python packages. · github.com, 4 Oct 2026
Purpose: Rusk is a package manager for JavaScript and Python that verifies artifacts before installing them. · github.com, 5 Oct 2026
Release security: The README says release binaries include minisign signatures for out-of-band verification and links a security file with the public key and instructions. · github.com, 5 Oct 2026
Security notifications: Anomaly reports can be sent to Slack, PagerDuty, Datadog, or any endpoint accepting JSON; the README says reports do not block installs. · github.com, 5 Oct 2026
Security policy: Users can configure signature and provenance requirements, run audits, and explain why a package was allowed or blocked. · github.com, 4 Oct 2026

Where Rusk stands on Freedom251

JavaScript Package Managers#14 of 19