What Is Aube, the Fastest Node.js Package Manager in 2026?

Node installs have been slow for years. You run npm install, walk to the coffee machine, come back, and CI is still resolving @types/node. Aube changes that equation. It finishes a warm CI install of a real 1,400-package project in 139 milliseconds—about 7.3x faster than pnpm and 3x faster than Bun on the same fixture. The key: it reads and writes your existing lockfile, so you can try it out without migrating your whole team.

Try Apidog today

This guide covers what Aube is, how to install and use it, how it compares to pnpm, npm, yarn, and Bun, and where it fits for API developers using tools like Apidog.

What is Aube?

Aube is a high-performance Node.js package manager from en.dev, released under the MIT license. Pronounced “ohb” (French for “dawn”), it’s currently in beta (v1.0.0-beta.10) and aims for pnpm v11 compatibility.

Aube’s core idea: use the same on-disk model as pnpm (global content-addressable store + isolated symlink layout), but rewrite the install pipeline in a natively-threaded language instead of JavaScript. This swaps the slow path out of Node, making it faster than both pnpm and Bun in real-world scenarios, while still reading and updating your existing pnpm-lock.yaml.

You don’t need to migrate your team. Aube can read pnpm-lock.yaml, package-lock.json, npm-shrinkwrap.json, yarn.lock, and bun.lock directly. You can use it locally while CI and teammates still run pnpm.

Aube Benchmarks: How Fast Is “Fastest”?

Aube’s benchmarks use a real-world ~1,400-package project, timed with hyperfine. All scenarios assume a committed lockfile. The main variable is cache warmth (warm = global store cached; cold = everything wiped).

Scenario	aube	bun	pnpm	yarn	npm
CI install (warm cache)	139ms	416ms	1.01s	2.43s	2.78s
CI install (cold cache)	1.12s	935ms	1.57s	6.60s	4.21s
install && run test (already set)	21ms	42ms	453ms	351ms	615ms
Add dependency (add is-odd)	209ms	414ms	1.33s	2.55s	2.89s

Key points:

• Warm CI install: Aube is 7.3x faster than pnpm and 3x faster than Bun—crucial for real CI pipelines.
• install && run test: Aube only needs 21ms if no changes, as it uses an install-state file to skip unnecessary work.
• Cold cache: Bun edges out Aube slightly, but this scenario is rare in daily workflows.

You can reproduce these results locally by running mise run bench from the Aube repo.

Why Is Aube So Fast?

Aube’s speed comes from three main design choices:

1. Native, Threaded Install Pipeline
   
   Unlike npm, pnpm, and yarn (which run installs in Node.js), Aube uses a natively compiled, multi-threaded runtime. This eliminates JavaScript overhead on hashing, tarball extraction, and symlinking.

2. Global Virtual Store by Default
   
   All dependencies are stored once globally. Multiple projects sharing, say, React or TypeScript, will symlink to the same files, saving ~90% disk compared to npm.

3. Install Short-Circuiting
   
   With a fresh install-state file, aube run test just checks hashes and skips the install phase entirely, making the install+test loop nearly instant.

This approach gives you the speed of a custom engine with the compatibility of pnpm’s lockfile and layout.

Installing Aube

Recommended: Using mise (polyglot tool manager):

mise use -g aube
aube --version

With npm:

npm install -g @endevco/aube

Using Homebrew (macOS/Linux):

brew install endevco/tap/aube

Pin Aube per-project:

mise use aube
# This writes Aube into mise.toml for version locking

See Aube’s installation docs for tarball and OS-specific methods.

Daily Aube Commands

Aube’s CLI closely matches pnpm, so switching is easy. Common commands:

aube install              # install dependencies
aube add react            # add a dependency
aube add -D vitest        # add a dev dependency
aube remove react         # remove a dependency
aube update               # update within package.json ranges
aube run build            # run a package.json script
aube test                 # run test script, installing first if stale
aube exec vitest          # run a local binary
aube dlx cowsay hi        # run a package in a throwaway env
aube ci                   # clean, frozen install for CI

Shortcuts:

• aube dev = aube run dev
• aubr build = aube run build
• aubx cowsay hi = aube dlx cowsay hi

For CI pipelines:

Use aube ci. It removes node_modules, checks the lockfile, and installs. If the lockfile is out of sync, it fails fast.

Lockfile Compatibility

Aube is low-friction to adopt because it reads and writes all major lockfiles in place:

Lockfile	Reads	Writes in place
aube-lock.yaml	yes	yes
pnpm-lock.yaml (v9)	yes	yes
package-lock.json (v2/v3)	yes	yes
npm-shrinkwrap.json	yes	yes
yarn.lock (v1 classic & v2+ berry)	yes	yes
bun.lock	yes	yes

Typical workflow:

• Team uses pnpm/CI runs pnpm install.
• You run aube install locally—same pnpm-lock.yaml is read and updated.
• Teammates can run either tool interchangeably.

Notes:

• Old pnpm v5/v6 lockfiles must be upgraded first.
• Yarn PnP projects need to switch to node_modules linker.

Security Defaults

Aube improves on npm’s security posture with three defaults:

• Minimum Release Age: New package versions wait out a configurable period before install, blocking quickly-yanked malicious releases.
• Exotic Dependency Blocking: Transitive dependencies with suspicious URLs, patch entries, or Git refs are blocked unless explicitly approved.
• Lifecycle Script Approval: Postinstall scripts are skipped by default. Use aube approve-builds to allow only the scripts you trust.

This moves the security model from “silently run everything” to “explicitly approve what runs.”

Node Modules Layout

Aube uses an isolated node_modules:

• Top-level node_modules/: only your direct dependencies.
• Transitive dependencies: under node_modules/.aube/.
• Packages are stored once at $XDG_DATA_HOME/aube/store/ (~/.local/share/aube/store/ by default).

Implications:

• Shared disk storage for overlapping dependencies.
• Phantom dependencies (undeclared in package.json) are blocked.
• Repeat installs are fast—just hard-linking from the store.

If you’re migrating from classic npm/yarn v1, fix any broken phantom imports by adding the missing package to package.json.

Workspaces & Monorepos

Aube supports workspaces and the workspace: protocol:

aube install -r
aube run test -r
aube add zod --filter @acme/api

• Reads both pnpm-workspace.yaml and aube-workspace.yaml.
• -r (recursive) and --filter options work as in pnpm.
• Works seamlessly with monorepo tools like turborepo and nx.

For API monorepos:

If your CI runs install/build/test/publish for each merge, Aube’s speed (139ms warm install) can save you real time.

Integrating Aube into API Workflows

If you’re building APIs, install speed is on your hot path—every schema change or contract test triggers a new install.

A practical loop:

1. Design/mock the API in Apidog
2. Generate a typed client or run contract tests using Apidog’s mock server
3. Use Aube locally for sub-second installs during iteration
4. Run the same tests in CI with aube ci

If you’re already running Apidog in VS Code, adding Aube requires one line in mise and speeds up every hot reload.

Migrating from Other Package Managers

• From npm: Run aube install. It reads and updates package-lock.json. Watch for phantom import errors—add missing packages to package.json. See the npm-users guide.
• From pnpm: Lowest friction. Reads pnpm-lock.yaml, supports workspace: protocol and filters. See pnpm-users guide.
• From yarn: Reads both v1 and v2+ lockfiles. Yarn PnP users need to switch to node_modules mode.
• From Bun: Reads bun.lock. Bun’s package manager is tied to Bun’s JS runtime; Aube is standalone and Node-compatible.

Real-World Considerations

• Beta Status:
  
  As of April 2026, Aube is v1.0.0-beta.10. It’s targeting pnpm v11 compatibility, but not yet widely tested. Trial locally before using in production CI.

• Scope:
  
  Aube focuses on installs—not runtime management or registry helpers. For tasks like whoami, token, or search, keep npm in your toolchain.

• Platform Support:
  
  mise supports macOS, Linux, and Windows via WSL. Native Windows via tarball is early-stage—see the install docs.

• Community:
  
  There’s an active Discord (linked from Aube’s homepage) and GitHub repo.

FAQ

What does “aube” mean?

Dawn, in French. Pronounced “ohb”.

Is Aube a drop-in replacement for pnpm?

Almost. It targets pnpm v11 compatibility and matches most workflows. Registry helpers and runtime management are out of scope.

Can I use Aube in CI while keeping pnpm locally?

Yes, or vice versa—Aube and pnpm can share and update the same lockfile.

How does Aube compare to Bun?

Aube is ~3x faster on warm installs; Bun is slightly faster on cold installs. Bun ships a JS runtime; Aube is install-only and works with Node.

Does Aube work on Windows?

Yes, via WSL. Native Windows support exists but is less mature. mise is recommended for all OSes.

Is Aube open source?

Yes, MIT-licensed, source on GitHub.

What happens to my existing pnpm-lock.yaml?

Aube reads and writes it in place. Teammates see any lockfile updates as usual.

The Bottom Line

For most Node projects in 2026, installs are slower than they should be. Aube is the fastest Node.js package manager for the CI and hot-reload loops that matter: 139ms for a 1,400-package install, 21ms for install && test when nothing changed, 90% less disk use in multi-project setups. It reads your existing lockfile and prioritizes security defaults.

If you already use a fast, local-first API client like Apidog, Aube completes the picture for Node installs. Try pairing them on your next Node service and see how much tighter your feedback loop gets.