Rusk
Rusk is a free package manager for JavaScript and Python that verifies package integrity and trust before installation.
What Rusk is
Rusk is a free package manager for JavaScript and Python that verifies package integrity and trust before installation. It detects rusk.toml, package.json, pyproject.toml, and requirements.txt, so existing projects can be used without a configuration file. During downloads it checks SHA-256 digests, while its lockfile pins transitive dependencies with exact digests and can migrate from npm, Yarn, and pnpm. Rusk verifies npm ECDSA signatures and PyPI PEP 740 attestations, and can detect provenance changes during updates. Users can set signature and provenance rules, run audits, and explain why a package was allowed or blocked. Build isolation uses environment scrubbing with process or container backends. Commands provide JSON output and structured CI exit codes. Anomaly reports can go to Slack, PagerDuty, Datadog, or any JSON endpoint, without blocking installs. Rusk supports npm, PyPI, custom indexes, Git dependencies, offline cache use, and Linux, macOS, and Windows.
Good
- Checks SHA-256 package digests
- Verifies signatures and provenance
- Migrates npm, Yarn, and pnpm lockfiles
- Isolated build sandbox options
- Structured JSON CI output
Watch out
- Anomaly reports do not block installs
- Source builds require Rust 1.75 or later
- Windows release listing specifies x64 for v0.1.1
Who it suits
Rusk suits JavaScript and Python projects, including mixed-language monorepos and CI pipelines. It is aimed at teams that need package verification, lockfile control, and machine-readable CI results.
Verdict
Rusk focuses package installation around digest checks, trust policies, and reproducible lockfiles. Its CI output, sandboxing, and migration support are useful when security controls matter across JavaScript and Python projects.
The facts
Each one read from Rusk's own pages, with the date it was checked.
What it does
- Audience
- The README describes Rusk as usable for JavaScript and Python projects, including mixed-language monorepos and CI pipelines.checked 5 Oct 2026
- Build isolation
- Rusk includes a build sandbox with process and container backends and environment scrubbing.checked 5 Oct 2026
- CI and alerts
- Rusk supports structured exit codes, JSON output, and anomaly reports sent to Slack, PagerDuty, Datadog, or any endpoint accepting JSON.checked 4 Oct 2026
- CI output
- All commands support JSON output, and Rusk provides structured CI exit codes.checked 5 Oct 2026
- Distribution
- The README gives GitHub release binaries, Cargo installation, and source build as installation options; building from source requires Rust 1.75 or later.checked 5 Oct 2026
- Existing projects
- It auto-detects package.json, requirements.txt, and pyproject.toml, and the README says no configuration file is needed for existing projects.checked 5 Oct 2026
- Installation
- The README gives installation options through release binaries, cargo install, or building from source with Rust 1.75 or later.checked 4 Oct 2026
- Install integrity
- Rusk checks package SHA-256 digests during downloads and pins package digests in its lockfile.checked 5 Oct 2026
- Integrity checks
- It verifies package SHA-256 digests and checks content-addressed cache integrity.checked 4 Oct 2026
- License
- The project is licensed under Apache-2.0.checked 4 Oct 2026
- Lockfiles
- Its lockfile pins transitive dependencies with exact digests and supports migration from npm, Yarn, and pnpm lockfiles.checked 4 Oct 2026
- Manifest support
- Rusk auto-detects rusk.toml, package.json, pyproject.toml, and requirements.txt.checked 4 Oct 2026
- Migration and compatibility
- The README says Rusk can migrate lockfiles from npm, Yarn, and pnpm and supports .npmrc authentication tokens with environment variable expansion.checked 5 Oct 2026
- Other package sources
- The feature list includes custom index URLs, Git dependencies, and .npmrc authentication token support.checked 4 Oct 2026
- Package sources
- Rusk supports npm and PyPI registries, custom index URLs, and Git dependencies.checked 5 Oct 2026
- Policy controls
- Users can configure signature and provenance requirements and use audit, verify, and explain commands to inspect package trust.checked 5 Oct 2026
- Product
- Rusk is a package manager for JavaScript and Python that verifies artifacts before installation.checked 4 Oct 2026
- Project status
- The repository describes Rusk as a working package manager for installing JavaScript and Python packages.checked 4 Oct 2026
- Purpose
- Rusk is a package manager for JavaScript and Python that verifies artifacts before installing them.checked 5 Oct 2026
- Release security
- The README says release binaries include minisign signatures for out-of-band verification and links a security file with the public key and instructions.checked 5 Oct 2026
- Security notifications
- Anomaly reports can be sent to Slack, PagerDuty, Datadog, or any endpoint accepting JSON; the README says reports do not block installs.checked 5 Oct 2026
- Security policy
- Users can configure signature and provenance requirements, run audits, and explain why a package was allowed or blocked.checked 4 Oct 2026
Where it runs
- Download platforms
- The README says release binaries are available for Linux, macOS, and Windows on x86_64 and aarch64; the releases page lists a Windows x64 binary for v0.1.1.checked 4 Oct 2026
- Platforms
- The README provides release binaries for Linux, macOS, and Windows on x86_64 and aarch64.checked 5 Oct 2026
