Nub: a Rust-built toolkit that bolts Bun-style DX onto stock Node.js

Nub is a Rust-written command-line toolkit that aims to give Node.js developers the conveniences of Bun and Deno without swapping out the runtime. Rather than shipping its own JavaScript engine, it augments the Node you already have by leaning on newer extension points—preload hooks via —import/—require, module.registerHooks() for transpilation and resolution, and an embedded oxc transpiler delivered as an N-API native addon. The result runs TypeScript, JSX, and decorators with no build step, auto-loads .env files, unflags experimental Node features like node:sqlite and WebSocket, and polyfills modern APIs such as Temporal where the underlying Node version lacks them. It also doubles as a Node version manager, inferring the expected version from files like .node-version or package.json#engines and installing it on demand.

The pitch is consolidation plus speed. A single binary covers running files (a node-compatible drop-in), a script runner that claims roughly 24× faster dispatch than pnpm run by avoiding any JS startup, an npx replacement (nubx) it pegs at ~19× faster, a pnpm-compatible package manager built on its “Aube” engine, and Corepack-style shims for teams that want to keep their existing tooling. The CLI mirrors pnpm and npx flags—including the full —filter workspace grammar—to preserve muscle memory, and a setup-nub GitHub Action is offered as a one-to-one swap for actions/setup-node.

Notably for a package manager, Nub ships with several supply-chain defenses on by default: postinstall scripts are blocked, resolution checks osv.dev for known-malicious versions, provenance downgrades are refused, and a 24-hour minimumReleaseAge guards against freshly published malicious releases. That security-by-default posture, combined with its compatibility-first design and MIT license, positions Nub less as a rival runtime and more as a faster, safer wrapper around the Node ecosystem developers already use.