Rusk
github.com
What it is
Rusk is a free package manager for JavaScript and Python that verifies package artifacts before installation. It works with npm and PyPI registries, custom index URLs, and Git dependencies. The tool detects rusk.toml, package.json, pyproject.toml, and requirements.txt, so existing projects can be used without a configuration file. During downloads it checks SHA-256 digests, while its lockfile pins transitive dependencies with exact digests and can migrate npm, Yarn, and pnpm lockfiles. Rusk verifies npm ECDSA signatures and PyPI PEP 740 attestations and detects provenance changes during updates. Users can require signatures or provenance, run audits, and inspect why a package was allowed or blocked. Build isolation uses environment scrubbing with process or container backends. Commands provide structured exit codes and JSON output for CI. Anomaly reports can be sent to Slack, PagerDuty, Datadog, or any JSON endpoint; reports do not block installs. Release binaries, Cargo installation, and source builds are available, with source builds requiring Rust 1.75 or later. Rusk runs on Linux, macOS, and Windows, supports x86_64 and aarch64 binaries, and is licensed under Apache-2.0.
Spec sheet
- Purpose
- Rusk is a package manager for JavaScript and Python that verifies artifacts before installing them.Read 5 Oct 2026 · github.com
- Product
- Rusk is a package manager for JavaScript and Python that verifies artifacts before installation.Read 4 Oct 2026 · github.com
- Audience
- The README describes Rusk as usable for JavaScript and Python projects, including mixed-language monorepos and CI pipelines.Read 5 Oct 2026 · github.com
- Platforms
- The README provides release binaries for Linux, macOS, and Windows on x86_64 and aarch64.Read 5 Oct 2026 · github.com
- License
- The project is licensed under Apache-2.0.Read 4 Oct 2026 · github.com
- Build isolation
- Rusk includes a build sandbox with process and container backends and environment scrubbing.Read 5 Oct 2026 · github.com
- CI and alerts
- Rusk supports structured exit codes, JSON output, and anomaly reports sent to Slack, PagerDuty, Datadog, or any endpoint accepting JSON.Read 4 Oct 2026 · github.com
- CI output
- All commands support JSON output, and Rusk provides structured CI exit codes.Read 5 Oct 2026 · github.com
- Distribution
- The README gives GitHub release binaries, Cargo installation, and source build as installation options; building from source requires Rust 1.75 or later.Read 5 Oct 2026 · github.com
- Download platforms
- The README says release binaries are available for Linux, macOS, and Windows on x86_64 and aarch64; the releases page lists a Windows x64 binary for v0.1.1.Read 4 Oct 2026 · github.com
- Existing projects
- It auto-detects package.json, requirements.txt, and pyproject.toml, and the README says no configuration file is needed for existing projects.Read 5 Oct 2026 · github.com
- Install integrity
- Rusk checks package SHA-256 digests during downloads and pins package digests in its lockfile.Read 5 Oct 2026 · github.com
- Installation
- The README gives installation options through release binaries, cargo install, or building from source with Rust 1.75 or later.Read 4 Oct 2026 · github.com
- Integrity checks
- It verifies package SHA-256 digests and checks content-addressed cache integrity.Read 4 Oct 2026 · github.com
- Lockfiles
- Its lockfile pins transitive dependencies with exact digests and supports migration from npm, Yarn, and pnpm lockfiles.Read 4 Oct 2026 · github.com
- Manifest support
- Rusk auto-detects rusk.toml, package.json, pyproject.toml, and requirements.txt.Read 4 Oct 2026 · github.com
- Migration and compatibility
- The README says Rusk can migrate lockfiles from npm, Yarn, and pnpm and supports .npmrc authentication tokens with environment variable expansion.Read 5 Oct 2026 · github.com
- Other package sources
- The feature list includes custom index URLs, Git dependencies, and .npmrc authentication token support.Read 4 Oct 2026 · github.com
- Package sources
- Rusk supports npm and PyPI registries, custom index URLs, and Git dependencies.Read 5 Oct 2026 · github.com
- Policy controls
- Users can configure signature and provenance requirements and use audit, verify, and explain commands to inspect package trust.Read 5 Oct 2026 · github.com
- Project status
- The repository describes Rusk as a working package manager for installing JavaScript and Python packages.Read 4 Oct 2026 · github.com
- Release security
- The README says release binaries include minisign signatures for out-of-band verification and links a security file with the public key and instructions.Read 5 Oct 2026 · github.com
- Security notifications
- Anomaly reports can be sent to Slack, PagerDuty, Datadog, or any endpoint accepting JSON; the README says reports do not block installs.Read 5 Oct 2026 · github.com
- Security policy
- Users can configure signature and provenance requirements, run audits, and explain why a package was allowed or blocked.Read 4 Oct 2026 · github.com
- Signatures and provenance
- The README says Rusk verifies npm ECDSA signatures and PyPI PEP 740 attestations, and detects provenance changes on update.Read 5 Oct 2026 · github.com
- Support and maker details
- The opened repository pages identify the maintainer as harishsg993010 but do not state a support channel, headquarters, or founding date.Read 4 Oct 2026 · github.com
Strong points and limits
Strong points
- Checks SHA-256 package digests
- Verifies npm and PyPI attestations
- Migrates common lockfiles
- Isolated build sandbox available
- Structured JSON output for CI
Limits
- Anomaly reports do not block installs
- Source builds require Rust 1.75 or later
- Release availability differs by architecture
Who it suits
It suits JavaScript and Python projects, including mixed-language monorepos and CI pipelines, where package integrity and provenance policies matter.
Verdict
Rusk focuses on package trust, reproducible lockfiles, and CI-friendly verification for JavaScript and Python. Its free, cross-platform distribution fits teams willing to adopt its security and policy workflow.
Where Specifiction places it
- JavaScript Package Managers#15 of 197.3
