Official Socket Security scanner for Bun's package installation process. Protects your projects from malicious packages, typosquatting, and other supply chain attacks.
Bun's package installer exposes a security-provider API that lets a scanner
vet every package before it is installed. This repo is Socket's implementation
of that provider: it checks each package against Socket's threat intelligence
during bun install, blocking malware, typosquats, and other supply-chain
attacks before they reach your machine. It runs with no configuration in free
mode, and applies your Socket organization's policy when a token is present.
- 🛡️ Real-time security scanning during package installation
- 🔍 Detects malware, typosquatting, and supply chain attacks
- ⚡ Optimized batching for fast scans
- 🔐 Supports both authenticated (Socket org) and free modes
- 🎯 Native integration with Bun's security provider API
bun add -d @socketsecurity/bun-security-scannerAdd to your bunfig.toml:
[install.security]
scanner = "@socketsecurity/bun-security-scanner"Without a token, the scanner runs in free mode using Socket's public API.
Authentication (optional)
Use the Socket CLI to save a token for your Socket organization:
pnpm add --global socket
socket login
bun installEnter a token with the packages scope when prompted. The scanner reads the saved token from your user-level Socket CLI settings.
See Contributing for setup and validation commands.
MIT