I'm Yusup, one developer from Turkmenistan. For the last 6 months I've been
building a package manager for the JS world, alone, and I just put the core
out under MIT. I'm sharing it here because open source is the whole reason it
exists the way it does.
Why I started: every npm install drops a few hundred packages on your machine,
and most people, me included, have no real idea what's in there or whether any
of it is vulnerable. A tool with that much access to your projects shouldn't be
a black box. If something downloads and runs code on my computer, I want to be
able to open it and read exactly what it does. That's why the source is public,
not just a binary.
It's called jet. It works with your existing package.json and lockfile, no
migration. Some of what it does:
\- Written in Rust with zero dependencies, std only. One static binary, \~2MB. I
kept a strict rule: if I couldn't write a part myself, I didn't pull a crate
for it. The resolver, tar/gzip, the registry client, the hashing, all mine.
Slower to build, much easier to read and audit.
\- jet audit checks your installed packages against known CVEs.
\- 13 mirrors with automatic switching, plus a GitHub fallback if every mirror
is down, so a bad network doesn't block you.
\- Offline-first, and it resumes an interrupted download from where it stopped.
\- Works on Windows, macOS and Linux.
The core is free and will stay free, MIT. There's a paid layer for extra
tooling, but that's not why I'm posting, and nothing in the open core is
crippled to push it.
I'm one person, no team, no company. It's young and rough in places. I'd
rather hear what's wrong with it now than keep polishing it alone.
Code: [github.com/y6861977-ui/jet](http://github.com/y6861977-ui/jet)
Site: [https://jet.kim/\](https://jet.kim/)
If you've looked at package manager internals: what would it take for you to
trust a new one with a real project?