Aube Package Manager

A Rust-based Node.js package manager that reads and writes your existing lockfiles in place, whether you're coming from pnpm, npm, yarn, or bun. No migration required. It uses a global content-addressable store and claims faster installs than pnpm or Bun, especially on warm CI. The security model is opinionated: lifecycle scripts are blocked by default and require explicit approval, and new package releases wait a minimum age before being pulled. The lockfile compatibility is genuinely useful if you're in a monorepo or working across teams with different tooling. Use `aube ci` in CI pipelines, and the multicall shims (`aubr build`, `aubx cowsay`) are a nice touch for reducing keystrokes.

skills.sh installs: 286
GitHub stars: 26
last updated: Jun 3, 2026

View on GitHub

Install

$ npx -y skills add aradotso/trending-skills --skill aube-package-manager --agent claude-code

Installs into .claude/skills of the current project.

Files

Aube Package Manager

Skill by ara.so — Daily 2026 Skills collection.

Aube is a fast Node.js package manager written in Rust. It drops into existing projects by reading and writing existing lockfiles (pnpm-lock.yaml, package-lock.json, yarn.lock, bun.lock), uses a global content-addressable store to reduce disk usage, and delivers dramatically faster installs than pnpm or Bun — especially on warm CI.

Installation

Via mise (recommended)

# Install globally
mise use -g aube

# Pin to a project
mise use aube

# Verify
aube --version

Via npm

npm install -g @endevco/aube

Via Homebrew (beta tap)

brew install endevco/tap/aube

Core Concepts

Lockfile compatibility: Reads and writes existing lockfiles in place — no forced migration.
Global store: Package files live in ~/.local/share/aube/store/ (XDG) and are shared across projects.
Isolated layout: Packages link through node_modules/.aube/ — phantom dependencies are blocked.
Secure defaults: New package releases wait a minimum age; lifecycle scripts require explicit approval.