Nub: The Zod Creator's Bet on Augmenting Node.js (Not Replacing It)

By John | July 29, 2026

If you've been doing Node.js development long enough, you know the ritual. Fire up a TypeScript project: install tsx, configure tsconfig-paths, add dotenv for environment variables. Then npm run dev takes 300ms, pnpm install takes 3 seconds, and npx prisma generate takes 200ms. You're not coding — you're waiting for tools to start.

Deno and Bun tried to fix this by replacing Node entirely. The problem? Migration costs. Deno reaches 77.4% Node compatibility; Bun barely hits 40.5%. Teams don't want to rewrite their import paths, swap package managers, or risk lock-in to a new runtime.

Colin McDonnell — the creator of Zod (30K+ GitHub stars) and former Bun devrel engineer — just shipped a different answer. It's called Nub, and its philosophy is dead simple: don't replace Node. Augment it.

What Nub Actually Is

Nub is a single Rust binary that acts as an all-in-one toolkit for Node.js. It transpiles TypeScript/JSX in memory using oxc, then hands the output to the real node binary underneath. There's no Nub runtime — your code runs on stock Node.

The result? 98.8% Node compatibility (vs Deno's 77.4% and Bun's 40.5%), zero lock-in, and dramatically faster tooling.

# Instead of:
npx tsx index.ts

# You write:
nub index.ts

Six Core Features That Matter

1. `nub <file>` — TypeScript, Zero Config

Nub runs .ts, .tsx, and .jsx files directly on stock Node, with full support for:

TypeScript (not just type stripping — enums, parameter properties, decorators all work)
JSX in .tsx files
Path aliases from tsconfig.json (no more tsconfig-paths)
Automatic .env loading (no more dotenv)
JSON/YAML/TOML imports directly
Extensionless imports (import { Model } from "./base" → ./base.ts)

Performance: nub hello.ts runs in 44ms, identical to node hello.js and 2.9× faster than tsx (128ms).

// These all just work with nub — no config:
import { Model } from "./base"       // extensionless → ./base.ts

enum Status { Draft, Sent, Paid }

class Invoice extends Model {
  constructor(public status = Status.Draft) {} // parameter property
}

await using db = await connect()     // explicit resource management

import config from "./config.yaml"   // YAML → parsed object

2. `nub run` — 24× Faster Than `pnpm run`

Running pnpm run dev takes ~443ms because Node cold-loads pnpm's entire JavaScript stack. Nub's Rust binary dispatches scripts in 14.7ms.

Tool	Execution Time	Relative Speed
`nub run`	14.7ms	baseline
`node --run`	32.2ms	2.2× slower
`npm run`	329.9ms	22× slower
`pnpm run`	442.7ms	30× slower

Fully flag-compatible with pnpm run:

nub run build                                  # basic
nub run test -- --coverage                     # arg forwarding
nub -r --if-present lint                       # skip missing scripts
nub -r --parallel --no-bail test               # parallel workspace
nub -r --resume-from @org/api --stream build   # CI restart

3. `nubx` — 19× Faster Than `npx`

npx is a JavaScript program with ~200ms cold start — even for instantaneous CLI commands. nubx resolves node_modules/.bin in Rust and execs the binary directly.

Tool	Execution Time	Relative Speed
`nubx esbuild --version`	11ms	baseline
`pnpm exec`	191ms	17× slower
`npx`	226ms	19× slower

4. `nub install` — 2.5–5× Faster Than `pnpm`

Powered by the aube Rust engine. Content-addressed storage with hard links — same strategy as pnpm, but with a faster resolver and linker.

Tool	Install Time (222 deps)
`nub install`	1,122ms
`bun install`	1,444ms (29% slower)
`pnpm install`	2,847ms (2.5× slower)
`npm install`	4,163ms (3.7× slower)

But speed isn't even the headline here. Nub's security defaults are the real story.

5. Supply-Chain Security by Default

Nub is aggressively secure out of the box:

Build scripts are deny-by-default — no postinstall runs until you nub approve-builds
Malicious package blocking — queries OSV database on every resolve
Provenance enforcement — refuses versions with downgraded trust evidence
24-hour cooling period — newly published versions are held back (matching pnpm's minimumReleaseAge)

$ nub add @ledgerhq/connect-kit
Error: refusing to add malicious package(s):
  - @ledgerhq/connect-kit (MAL-2023-8697)

$ nub install
Error: trust downgrade for [email protected]
  earlier version had provenance, this one doesn't

6. Built-in Node Version Manager

$ echo 26 > .node-version
$ nub hello.ts
Using Node.js 26.5.0 (resolved from .node-version)
Installed in 9.8s
Hello world!

Reads .node-version, .nvmrc, or engines field. Downloads, verifies checksums, installs on the fly. Replaces nvm and fnm.

The Philosophy: Zero Lock-In

This is Nub's killer feature for risk-averse teams. There is:

✗ No Nub global object
✗ No nub:* module namespace
✗ No @nub/* npm scope
✗ No "nub" field in package.json
✗ No nub-specific lockfile

It reads your existing lockfile (npm, pnpm, or bun) and writes the same format back. If you stop using Nub tomorrow, your project is exactly as it was — no migration, no cleanup.

Who This Is For

Use Nub if:

Your team uses Node + pnpm and doesn't want to change runtimes
You want TypeScript to "just work" without tsx/ts-node/tsconfig-paths
You care about supply-chain security and want it on by default
You're tired of waiting for pnpm run and npx
You want zero lock-in

Stick with tsx if:

You only need TypeScript execution and nothing else

Stick with Bun/Deno if:

You're starting a greenfield project and want a full alternative runtime
You're willing to accept the compatibility tradeoffs

Author Credibility

Colin McDonnell (@colinhacks) is the creator of Zod (30K+ GitHub stars), tRPC, and the Standard Schema specification. He previously worked at Bun, giving him deep insight into both the TypeScript ecosystem and the limitations of alternative runtimes. Nub is his fifth project to cross 1,000 GitHub stars — and it hit that milestone fast.

The Bottom Line

Nub isn't flashy. It doesn't promise a revolution. It's a Rust-powered Swiss Army knife that makes your existing Node.js workflow faster, safer, and more pleasant — and you can walk away from it anytime. That's a remarkably pragmatic bet in an ecosystem that's been burned by runtime migrations before.

For teams already on Node, Nub might be the most impactful toolchain upgrade of 2026.

Try it: curl -fsSL https://nubjs.com/install.sh | bash

GitHub: nubjs/nub (3.3K+ stars, MIT)

Have you tried Nub yet? What's your experience? Drop a comment below.