JavaScript installer pnpm recast in Rust because ECMAScript can't keep up

DEVOPS

Fully backward-compatible upgrade promises zero-friction speedup for monorepo wranglers.

The popular JavaScript package manager pnpm, already known for its speedy downloads, has further cut installation times by up to 90 percent thanks to a complete rewrite in Rust.

Yet the freshly released version 12 of pnpm should not cause consternation while upgrading, its maintainer says.

“Upgrading should not feel like a migration. The commands, flags, settings, and lockfile format of pnpm 11 all carry over, and the documentation covers both versions,” wrote Zoltan Kochan, the current lead maintainer of pnpm.

In the project’s own benchmarks, pnpm 12 installed a sample uncached package in 5.19 seconds, compared to the 8.22 seconds pnpm 11 required and the 47.7 seconds npm itself required.

The project team also built a registry server in Rust, called pnpr, which improves performance even further. In the above test, the installation took only 3.37 seconds with pnpr on the backend.

A new Rust core binary, on which work started in April, eliminates a lot of the overhead that comes from routing filesystem work through Node.js. This new version is 65.9 percent Rust and 33.5 percent TypeScript, according to the GitHub stats. 

“Package installation is dominated by fetching metadata and tarballs, unpacking files, resolving dependency graphs, and linking packages into node_modules, making it a natural target for native code and parallelism,” wrote Sarah Gooding, vice president of communications for security provider Socket, in a blog post. 

Gooding also noted that the project benchmarked pnpm against Bun and Yarn, but the results were removed due to testing SNAFUs. Nonetheless, she noted the software cut install times by up to 90 percent in some cases.

A faster npm

Developer Rico Sta. Cruz originally created pnpm in 2016 as a faster alternative to npm (Node Package Manager), JavaScript’s de facto package manager, which devs used to find and download libraries and tools. GitHub acquired the open source npm software and repository in 2020.

Npm garnered a reputation for being both sluggish and hungry for disk space, thanks to its generous practice of downloading all needed dependencies onto users’ machines, regardless of whether they were duplicates. 

Pnpm’s secret sauce is content-addressable storage. If you need a single library for 100 different applications, pnpm downloads it only once, and downloads another copy only if the developer specifies a different version.

Like npm, pnpm still draws from the official npm repository, but arguably works better than npm for many. Many devs also like that the lockfile describing the package’s dependency tree was more readable thanks to its use of YAML.

The 2025 State of JavaScript survey showed that pnpm was by far the most popular package manager for JavaScript monorepos, a party that also included Nx, Lerna, Yalc, Turborepo and even npm’s built-in Workspaces. About 38 percent (3,840) of 10,251 surveyed developers used the package manager.

Rust for JavaScript

Rewriting applications in Rust seems to be a favorite activity these days, as the language is known for speedy performance unhampered by garbage collection. 

In the Web app ecosystem alone, the Bun framework just got an AI-fueled Rust makeover, Tailwind CSS version 4 got a new Rust engine called Oxide, and the Vite framework now speeds along thanks to a Rust-built JavaScript bundler called Rolldown. 

“It is a bit of [an] indictment on Node for having poor dx” (developer experience), wrote Darcy Clarke, CEO of JavaScript package management platform provider vlt, in an X message, about the Rust rewrite of pnpm. 

“It was faster to rewrite pnpm in rust than to migrate to esm” (ECMAScript modules), replied pnpm's Kochan, agreeing with Clarke’s sentiment. 

The software’s GitHub page still points at the last major release, pnpm 11.25, so existing users will have to update to the v12 branch specifically (“pnpm self-update next-12” will get you there). ®