--- title: upm Launches as a Fast, Tiny Package Manager Written in... description: Pooya Parsa, creator of Nitro and UnJS and a longtime Nuxt contributor, has released upm, a TypeScript-based npm package manager built on Node.js's native... canonical: https://daily.dev/posts/upm-launches-as-a-fast-tiny-package-manager-written-in-typescript-08is375sq twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: upm Launches as a Fast, Tiny Package Manager Written in TypeScript | daily.dev og:description: Pooya Parsa, creator of Nitro and UnJS and a longtime Nuxt contributor, has released upm, a TypeScript-based npm package manager built on Node.js's native... og:url: https://daily.dev/posts/upm-launches-as-a-fast-tiny-package-manager-written-in-typescript-08is375sq og:image: https://api.daily.dev/og/posts/08Is375Sq.png og:image:alt: upm Launches as a Fast, Tiny Package Manager Written in TypeScript og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # upm Launches as a Fast, Tiny Package Manager Written in TypeScript **[Socket](https://daily.dev/sources/socketdev)** · 5 min read · 0 upvotes · 0 comments ## Summary Pooya Parsa, creator of Nitro and UnJS and a longtime Nuxt contributor, has released upm, a TypeScript-based npm package manager built on Node.js's native networking, worker threads, compression, and filesystem APIs. It ships in about 250 KB (84.5 KB packed) versus 48.6 MB for pnpm, and exposes a JavaScript API so it can be embedded in other tools without spawning a separate process. Benchmarks show upm leading on cold installs across Nitro, Nuxt, and Next.js (494 ms–1.07 s median), though pnpm edges it out on Nitro and it ranks fourth on warm installs behind Bun, aube, and Deno. Security defaults skip lifecycle install scripts and enforce a 24-hour minimum release age before selecting new dependency versions, both configurable. It supports installing from package-lock.json, pnpm-lock.yaml, and bun.lock files but cannot handle workspaces, patches, or Git/file dependencies in those lockfiles. As a prerelease, it lacks an update command, Git or local directory dependencies, and full peer dependency support. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### What is upm and how is it different from npm, pnpm, or Yarn? upm is a new TypeScript-based package manager for the npm registry created by Pooya Parsa, built on Node.js's own networking, worker threads, compression, and filesystem tools. It ships at around 250 KB on disk (84.5 KB packed), versus 48.6 MB for pnpm 12, and exposes a JavaScript API so it can be embedded directly in other tools instead of running as a separate process. _Developers weighing a new package manager against npm, pnpm, or Yarn can track releases like this on daily.dev._ ### Does upm run install scripts automatically like npm does? No, upm skips dependency lifecycle scripts during installation by default, a security choice meant to block malicious install scripts that would otherwise run immediately. It also defaults to a 24-hour minimum release age when selecting new package versions, giving time to catch bad releases before they land in a dependency tree; both defaults can be configured or disabled, and a package's command can still be run manually with upx. _Teams hardening install pipelines against supply-chain risks can follow security-default changes like this on daily.dev._ ### Can upm install a project that already has a pnpm-lock.yaml or bun.lock file? Yes, when there is no upm.lock file, upm can install package versions directly from package-lock.json, pnpm-lock.yaml, or bun.lock without modifying the existing file. However, this compatibility has major limits: those lockfiles cannot contain workspaces, patches, or Git or file dependencies, and upm cannot add or remove packages while relying on them. _Anyone testing a new tool against an existing lockfile setup can follow compatibility notes like this on daily.dev._ ## Similar posts on daily.dev - [What is Nub? The Rust toolkit making Node.js 20x faster](https://daily.dev/posts/what-is-nub-the-rust-toolkit-making-node-js-20x-faster-ppamgw7xa) · LogRocket · 1 upvotes · 0 comments - [uv is fantastic, but its package management UX is a mess](https://daily.dev/posts/uv-is-fantastic-but-its-package-management-ux-is-a-mess-dvqxsrkx0) · Planet Python · 0 upvotes · 0 comments - [pnpm 11 cuts the npm umbilical cord](https://daily.dev/posts/pnpm-11-cuts-the-npm-umbilical-cord-vhucinbuf) · Bytes by ui.dev · 50 upvotes · 5 comments --- Tags: [#nodejs](https://daily.dev/tags/nodejs), [#typescript](https://daily.dev/tags/typescript), [#npm](https://daily.dev/tags/npm) [View this post on daily.dev](https://daily.dev/posts/upm-launches-as-a-fast-tiny-package-manager-written-in-typescript-08is375sq) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"upm Launches as a Fast, Tiny Package Manager Written in TypeScript","url":"https://daily.dev/posts/upm-launches-as-a-fast-tiny-package-manager-written-in-typescript-08is375sq","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/upm-launches-as-a-fast-tiny-package-manager-written-in-typescript-08is375sq"},"datePublished":"2026-09-29T17:03:32.945Z","dateModified":"2026-09-29T19:29:41.916Z","description":"Pooya Parsa, creator of Nitro and UnJS and a longtime Nuxt contributor, has released upm, a TypeScript-based npm package manager built on Node.js's native...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/f544a5c6519d9e87e09f54eb33da2ad2?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/f544a5c6519d9e87e09f54eb33da2ad2?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Socket","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Socket","logo":"https://media.daily.dev/image/upload/s---oEn9czC--/f_auto/v1716187892/logos/socketdev","url":"https://daily.dev/sources/socketdev"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/upm-launches-as-a-fast-tiny-package-manager-written-in-typescript-08is375sq","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"nodejs,typescript,npm","timeRequired":"PT5M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Socket","item":"https://daily.dev/sources/socketdev"},{"@type":"ListItem","position":3,"name":"upm Launches as a Fast, Tiny Package Manager Written in TypeScript"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/upm-launches-as-a-fast-tiny-package-manager-written-in-typescript-08is375sq#faq","mainEntity":[{"@type":"Question","name":"What is upm and how is it different from npm, pnpm, or Yarn?","acceptedAnswer":{"@type":"Answer","text":"upm is a new TypeScript-based package manager for the npm registry created by Pooya Parsa, built on Node.js's own networking, worker threads, compression, and filesystem tools. It ships at around 250 KB on disk (84.5 KB packed), versus 48.6 MB for pnpm 12, and exposes a JavaScript API so it can be embedded directly in other tools instead of running as a separate process. Developers weighing a new package manager against npm, pnpm, or Yarn can track releases like this on daily.dev."}},{"@type":"Question","name":"Does upm run install scripts automatically like npm does?","acceptedAnswer":{"@type":"Answer","text":"No, upm skips dependency lifecycle scripts during installation by default, a security choice meant to block malicious install scripts that would otherwise run immediately. It also defaults to a 24-hour minimum release age when selecting new package versions, giving time to catch bad releases before they land in a dependency tree; both defaults can be configured or disabled, and a package's command can still be run manually with upx. Teams hardening install pipelines against supply-chain risks can follow security-default changes like this on daily.dev."}},{"@type":"Question","name":"Can upm install a project that already has a pnpm-lock.yaml or bun.lock file?","acceptedAnswer":{"@type":"Answer","text":"Yes, when there is no upm.lock file, upm can install package versions directly from package-lock.json, pnpm-lock.yaml, or bun.lock without modifying the existing file. However, this compatibility has major limits: those lockfiles cannot contain workspaces, patches, or Git or file dependencies, and upm cannot add or remove packages while relying on them. Anyone testing a new tool against an existing lockfile setup can follow compatibility notes like this on daily.dev."}}]} ```