The Nub blog

De-phantoming the npm ecosystem

Nub's install-time phantom detector, a scan of 10,000 high-download npm packages, and a larger package extensions database for other tools to use.

Nub 0.9

Bundles a compatibility database that repairs packages whose published code imports dependencies their own manifest never declares, and renames the root build allowlist.

Nub 0.8.3

Repairs the self-upgrade channel, adds a config field naming the exact Node binary a project runs, and fixes install and runtime issues on shipped binaries.

Nub 0.8.2

Ships the TypeScript loader as a standalone package for plain Node, and fixes a round of install, resolution, configuration, and compile issues.

Nub 0.8.1

Fixes a lockfile entry that pnpm 12 rejects, repairs global installs, and closes a round of Node-version and loader compatibility gaps in the runtime.

Nub 0.8.0

Reworks environment-file configuration, ships a round of package-manager correctness fixes, and adds garbage collection for the package store.

Nub 0.7.5

Bounds seven sources of unbounded memory retention, and fixes two defects in the upgrade command.

Nub 0.7.4

Adds guided configuration setup and reports missing registry packages before reputation warnings.

Nub 0.7.3

Running scripts on Windows works again after a launcher optimization moved the binary away from its shell, plus native TypeScript transform configuration.

nub.jsonc — The config file for Node.js you always wanted

Nub 0.7.2

A blocked release no longer blocks the whole command, plus per-invocation platform selection and workspace path resolution.

Nub 0.7.1

Homebrew installs again, and reinstalling no longer leaves the package manager shims on the previous binary.

Nub v0.7 — nub.jsonc, Varlock support, Promise.allKeyed, and more

A typed project config file, schema-driven environments through Varlock, and every Stage 3 library surface no supported Node ships.

Nub 0.6.0

One script body that behaves the same on macOS, Linux, and Windows, a trust floor that fails closed, and a canary release channel.

Nub 0.5.0

A TypeScript-first project scaffold, create templates that answer with Nub commands, and a batch of package manager fixes.

Nub 0.4.13

On Windows, the global content-addressable store now resolves under LOCALAPPDATA instead of a Unix-style .local\share path, matching the cache tier and Node's platform conventions.

Nub 0.4.12

Package-manager and runtime fixes centered on the global virtual store, plus Node version resolution from tool-versions files.

Nub 0.4.11

The install scripts gain two environment variables for relocating the install and skipping the shell-profile edit.

Nub 0.4.10

Expo projects below SDK 56 install with a project-local store, and a newly-added workspace member resolves on the shared lockfile layout.

Nub 0.4.9

pnpm named-registry support, so dependencies that resolve through a registry alias install under nub.

Nub 0.4.8

A lockfile-compatibility fix for nested-map engines values in pnpm-lock.yaml, plus documentation updates.

Nub 0.4.7

Dependencies whose install scripts swap a JavaScript launcher for a native binary now run correctly.

Nub 0.4.6

Native text imports on Node 26.5+, automatic support for new experimental modules, and removal-safe flag injection.

Nub 0.4.5

Broader pnpm patch-key support, catalog and Homebrew-upgrade fixes, and a faster hoisted link pass.

Nub 0.4.4

NODE_ENV again selects .env files as a fallback, clamped to the canonical development, production, and test values for Next.js and Bun parity.

Nub 0.4.3

Installs the full workspace-member set in Yarn Berry monorepos, aborts on unrecognized bun.lock sources, and updates the docs and benchmark numbers.

Node’s phantom dependency problem and the path to a 5x faster package manager

One copy of every package per machine, symlinked into every project — and the mechanisms that make that layout work across the ecosystem.

Nub 0.4.0

Nuxt 4 and VitePress run out of the box, and env-file mode is now selected by APP_ENV instead of NODE_ENV.

Nub 0.3.0

Undeclared (phantom) dependencies resolve out of the box, a unified nubx runs a file, script, local CLI, or registry package behind a consent-gated fetch, and more frameworks scaffold and run with no config change.

Nub 0.2.10

An unhandled worker failure is now fatal, matching Node's worker threads; a brand-boundary leak in package-manager config resolution is closed; and the post-target argument separator stays verbatim across every runner verb.

Nub 0.2.9: isolated node_modules by default

The default node_modules layout is now isolated for npm, Yarn, and Bun projects, backed by a global virtual store, alongside install-performance and diagnostics work.

Nub 0.2.8

Lockfile and linker fixes in the package-manager engine, a plain-JavaScript transpile fallback, and a trust-validation speedup.

Nub 0.2.7

Restores the upgrade path for sidecar-era 0.1.x installs, with warm-install store reuse, a lockfile-compatibility guard, and a watch-mode env-file fix.

Nub 0.2.6: reading legacy npm lockfiles

Nub reads the legacy npm lockfile formats it previously refused, with three smaller lockfile-compatibility fixes and a Homebrew install-path fix.

Nub 0.2.5

Adds the nub x spelling as a short alias of dlx, and corrects the run-a-package documentation.

Nub 0.2.4: a single self-contained binary

Nub now ships as a single self-contained binary with its runtime embedded, hardens self-provisioning and the embedded runtime, and quiets the install output.

Nub 0.2.3

A localStorage compatibility fix, two compat-floor polyfill families, a prebuilt Nix flake, and a startup-path speedup.

Nub 0.2.2

Project-source plain JavaScript is transpiled, the navigator global and Web Locks land on the compat floor, and the WPT slice expands.

Nub 0.2.1

Installs are resilient on resource-constrained CI and containers, and repeated work is shaved off the install and warm-cache paths.

Nub 0.2.0: Web Workers on stock Node

Nub adds the browser-standard Worker to stock Node — the same constructor and event surface you write for the web, with no Nub-specific API — and hardens package-manager compatibility across pnpm, yarn, and bun.

Nub 0.1.14

A Next.js and Turbopack build crash with Tailwind v4 is fixed, and npm's save-prefix is mirrored on add under an npm incumbent.

Nub 0.1.13

A fix for a false positive in the malicious-package check, where a bare, dist-tag, or range install could be wrongly blocked by an advisory on an older version.

Nub 0.1.12

Package-manager compatibility fixes — pnpm 11 monorepo installs and byte-identical bun lockfiles — an engine sync to 1.23.0, and a transpile-cache correctness fix.

Nub 0.1.11

Supply-chain hardening in CI, mechanized code-quality and brand-boundary lints, and a registry-trust fix for home-directory installs.

Nub 0.1.10

Package-manager compatibility fixes across bun and npm lockfiles, run and exec refinements, and a new Bun-to-Nub migration guide.

Nub 0.1.9

A package-manager configuration batch — an asymmetric global config model, pnpm 11 project-write alignment, and native implementations of the npm-only verbs.

Nub 0.1.8

A Node augmentation batch — an interactive-TUI hang fix, native-addon ESM imports, WebAssembly and ShadowRealm unflagging, and a tree-wide compatibility opt-out.

Nub 0.1.7

Global install aliases now work, install-family flags are pnpm-only, and help splits into a curated short form and a full reference.

Nub 0.1.6

Two reported correctness divergences fixed — duplicate SIGINT delivery on Ctrl-C, and a pnpm-generated patch that was wrongly rejected — plus output-prefix cleanup and site polish.

Nub 0.1.5

Package-manager fidelity — npm-lockfile round-trips and pnpm injected-dependency migration — with a tsconfig-cache crash fix and an internal Rust cleanup pass.

Nub 0.1.4

Lockfile compatibility across bun, yarn, npm, and pnpm — git dependencies, workspace members, and cross-tool conversions round-trip cleanly — plus release-profile performance tuning.

Nub 0.1.3

A CommonJS dynamic-import crash fix, a set of pnpm frozen-lockfile round-trip fixes, and package-manager compatibility tables on the docs site.

Nub 0.1.2

Package-manager, runtime, and installer fixes — lifecycle Node-version discovery, workspace resolution, and env-file parsing.

Nub 0.1.1

The first patch after launch — fresh-project identity on install, broader package-manager config compatibility, offline installs, and a dedicated nubx command grammar.

Introducing Nub: an all-in-one toolkit for Node.js

The all-in-one Node.js toolkit — a Rust CLI that augments stock Node with TypeScript that just runs, a faster script runner, and a fast bin runner.