Aube
Shares rank 24 of 35 package managers by recommenders
Node.js package manager from the mise author, with safety-first defaults and a 24-hour update cooldown. Critics say it looks vibe coded.
Node.js package manager from the mise author, with safety-first defaults and a 24-hour update cooldown. Critics say it looks vibe coded.
11 people gave an opinion
- recommend it
- 10
- criticize it
- 1
- approval share
- 91%
Recommended in 2 of 13 months
- November 2025: not recommended
- December 2025: not recommended
- January 2026: not recommended
- February 2026: not recommended
- March 2026: not recommended
- April 2026: recommended
- May 2026: recommended
- June 2026: not recommended
- July 2026: not recommended
- August 2026: not recommended
- September 2026: not recommended
- October 2026: not recommended
- November 2026: not recommended (month in progress)
Why it doesn’t carry the badge
- 10 people recommend itNeeds 10 or more, met.
- 10 recommenders for every criticNeeds 2 to 1 or better, met.
- Recommended in 2 of 13 monthsNeeds 4 or more, not met.
The same three rules apply to every product, and the badge can’t be bought. How the badge works
What people say about it
The reasons people give, with the number of comments that give each one. Open a reason to read what they said.
Why people recommend it
Each mark is one comment
Safety-first configuration defaults
“has a 24hr cooldown before trusting package updates and a no-trust option for trusting downgrades”
Comment from 23 May 2026 in “Aube – Node.js package manager in Rust” “what I really liked was the safety configuration defaults”
Comment from 21 Apr 2026 in “aube: A New Dawn for Node Installs (from mise author)” “It has the strongest security posture of any node pm.”
Comment from 12 May 2026 in “TanStack NPM Packages Compromised” Interesting new alternative
“Aube seems interesting to me, I have submitted it as show HN”
Comment from 4 May 2026 in “I am worried about Bun” “the creator of mise released a faster alternative”
Comment from 4 May 2026 in “I am worried about Bun”
What people warn about
Each mark is one comment
Appears vibe coded
“appears vibecoded which doesn't give me confidence, still interesting though”
Comment from 24 May 2026 in “Aube – Node.js package manager in Rust” “Interesting, but it's still vibe coded.”
Comment from 24 May 2026 in “Aube – Node.js package manager in Rust”
Other package managers people recommend
The four most recommended other package managers, with the same counts for each, so you can compare like for like. The tick on each bar marks the 2 to 1 line the badge needs.
See all 35 package managers, rankedWhat people said
11 of the 12 comments that mention it, newest first. Each links to the original comment.
“Interesting, but it's still vibe coded.”
“appears vibecoded which doesn't give me confidence, still interesting though”
“has a 24hr cooldown before trusting package updates and a no-trust option for trusting downgrades”
“It seems like the restrictions are only for lifecycle scripts, so wouldn't help if/when the package's actual code had malicious code inserted?”
“a single developer is a supply chain risk”
“It has the strongest security posture of any node pm.”
“the creator of mise released a faster alternative”
“Aube seems interesting to me, I have submitted it as show HN”
“aube was about 30% slower than pnpm in my testing on our hundreds-of-dependencies monorepo”
“Jails seems (to me) the most attractive feature in this package manager.”
“what I really liked was the safety configuration defaults”
Counts come from 1,795,640 Hacker News comments, November 2025 to November 2026. How we count. Report a mistake.