Skip to main content

Documentation Index

Fetch the complete documentation index at: https://mintlify.com/ara-home/ara/llms.txt

Use this file to discover all available pages before exploring further.

Ara is a package manager built for an era where supply chain attacks are routine. It scans every dependency for malicious patterns before anything is unpacked, resolves versions deterministically using Minimum Version Selection, and stores packages by SHA-256 hash so installs are always reproducible. Drop it into any existing npm project — no migration required.

Introduction

Learn what makes Ara different from npm, Yarn, and pnpm.

Installation

Install the Ara binary on Linux, macOS, or Windows.

Quickstart

Install your first project’s dependencies in under two minutes.

CLI Reference

Every command, flag, and default value documented.

​
Why Ara?

Built-in Security Analysis

Scans 17+ suspicious patterns — eval, child_process, prototype pollution, credential access — before any package touches your project.

Deterministic Resolution

Minimum Version Selection (MVS) guarantees identical dependency graphs across every machine and CI run.

Content-Addressed Store

Packages stored by SHA-256 hash. Identical packages are never duplicated. Rollbacks are trivial.

Sandboxed Execution

Run build and test scripts inside Linux seccomp-BPF profiles: Hermetic, Restricted, or Open.

​
Get started in minutes

1

Install Ara

Download the latest binary for your platform and put it on your PATH.
curl -fsSL https://github.com/ara-home/ara/releases/latest/download/ara-linux-x86_64 -o ara
chmod +x ara && sudo mv ara /usr/local/bin/
2

Install your project dependencies

Run ara install from any directory that contains a package.json. Ara reads it natively.
cd my-app
ara install
3

Review security findings

Ara scans every package before unpacking it. If a package contains suspicious code, Ara shows you exactly what it found and asks for your decision.
🔍 Scanning lodash@4.17.21...  OK
🔍 Scanning some-pkg@1.0.0...
  ⚠  eval-usage (critical) — eval() call in lib/utils.js:42
Allow some-pkg@1.0.0? [y/n/s]
4

Add new packages

Use ara add to install and save packages directly to package.json.
ara add zod
ara add --save-dev typescript

​
Explore the docs

Manifest Format

How package.json and ara.toml work together.

Workspaces

Monorepo support with the workspace: protocol.

Migrate from npm

Zero-migration path for existing npm projects.

Build docs developers (and LLMs) love

Get started for freeTalk to us