Nub

TypeScript-first Node.js toolkit that adds Bun/Deno-style ergonomics to stock Node: TS execution, faster script commands, package-manager shims, Node-version selection, and stricter install security.

What It Is

Nub is "everything but the runtime": it keeps Node.js as the execution runtime and uses newer extension points around preload scripts, module resolution hooks, and Node-API native addons to add higher-level development ergonomics. The design bet is conservative: get Bun-like convenience without asking a project to accept a second JavaScript runtime's compatibility edge cases. Source: X/@colinhacks launch thread, 2026-06-17

The launch thread positions Nub as a single command surface for:

• running TypeScript syntax that Node does not erase by default, including enums;
• resolving TypeScript-flavored imports, tsconfig paths, JSX, decorators, .env, YAML, and TOML;
• detecting and installing the right Node version from package.json#devEngines, .node-version, .nvmrc, or package.json#engines;
• acting as a flag-compatible node passthrough for normal Node usage;
• replacing common package commands with lower-overhead equivalents: nub run, nubx, and nub install;
• providing package-manager shims so existing pnpm, npm, or other workflows can incrementally adopt it.

The visual artifact is a launch card for nub. showing the same routing: nub index.ts, nub run dev, nubx prisma generate, nub install, nub watch src/server.ts, nub pm shim, and nub node install 26. Source: local artifact wiki/assets/x-bookmarks/2067295292945567756/image-01.jpg, reviewed 2026-06-30

Supply-Chain Posture

Nub is notable because its package-manager story adopts the defense model in npm Supply Chain Security as a default posture rather than an afterthought:

• a release-age quarantine is enabled by default;
• OSV vulnerability checks run during dependency resolution;
• untrusted postinstall scripts are blocked by default;
• provenance trust downgrades are blocked when a newer release lacks attestations that older releases had.

That makes Nub a useful candidate for experiments where install-time malware is the threat model. It is not yet a default replacement for Kevin projects: before adoption, verify lockfile round-tripping, workspace behavior, postinstall exceptions, and monorepo compatibility against the actual repo. Treat social performance claims as hypotheses until local benchmarks reproduce them.

Stack Fit

Use Nub as an evaluation target when a project wants Node compatibility with faster TypeScript/package-command ergonomics. The likely evaluation path is:

1. Run it in read-only or throwaway mode against an existing lockfile.
2. Compare node, pnpm, and nub behavior on scripts that exercise TS imports, environment loading, and workspace filters.
3. Check whether blocked postinstall scripts need explicit trust decisions.
4. Benchmark only commands Kevin actually runs repeatedly.
5. Record any adoption decision in the project tooling page before making it the default.

Do not route this as a generic "use the new package manager" recommendation. Its value is the combination of Node-runtime compatibility, TypeScript convenience, and install security.

Version Snapshot

As of 2026-06-30, npm reports @nubjs/nub@0.2.10 as latest, MIT licensed, with nub and nubx binaries, Node engine >=18.19.0, and repository github.com/nubjs/nub. The package was created on 2026-05-27 and 0.2.10 was published on 2026-06-30. Source: npm registry, 2026-06-30

---

Timeline

• 2026-06-30 | Page created from Colin McDonnell's Nub launch thread, local visual artifact, npm registry metadata, and GitHub repository metadata. Source: X/@colinhacks, 2026-06-17; npm registry, 2026-06-30
• 2026-06-17 | Public beta launch announced. The thread framed Nub as an all-in-one JavaScript toolkit that augments Node instead of replacing it. Source: X/@colinhacks, 2026-06-17