namespace

Security

namespace Security

Security scanner declarations for bun install

  • interface Advisory

    The result of a security scan of a package

    • description: null | string

      A brief description of the advisory, which Bun prints to the user. null if none is available.

    • level: 'warn' | 'fatal'

      The severity of the advisory.

      Bun always pretty-prints every advisory returned from the scan() hook, then:

      • if any is fatal, Bun immediately cancels the installation and exits with a non-zero exit code
      • otherwise, if any is warn, Bun asks whether to continue with the install when running in a TTY, and exits immediately when not
    • package: string

      The name of the package being installed.

    • url: null | string

      A URL linking to a CVE or report where users can learn more about the advisory, or null if none is available.

  • interface Package

    • name: string

      The name of the package

    • requestedRange: string

      The range the command requested: a tag like beta or a semver range like >=4.0.0

    • tarball: string

      The URL of the package tarball (.tgz) Bun downloads

    • version: string

      The exact version Bun resolved from the requested range, not a range itself.

  • interface Scanner

    • scan: (info: { packages: Package[] }) => Promise<Advisory[]>

      Performs an advisory check when the user runs bun add <package> [...packages] or a similar command.

      If this function throws, Bun immediately stops the install and prints the error to the user.

    • version: '1'

      The scanner API version this scanner implements.

      Bun uses it to distinguish API versions, since third-party scanner package versions are unrelated to Bun versions. A future revision of the API may drop support for version 1.