Official Socket Security scanner for Bun's package installation process. Protects your projects from malicious packages, typosquatting, and other supply chain attacks.
Bun's package installer exposes a security-provider API that lets a scanner
vet every package before it is installed. This repo is Socket's implementation
of that provider: it checks each package against Socket's threat intelligence
during bun install, blocking malware, typosquats, and other supply-chain
attacks before they reach your machine. It runs with no configuration in free
mode, and applies your Socket organization's policy when a token is present.
- 🛡️ Real-time security scanning during package installation
- 🔍 Detects malware, typosquatting, and supply chain attacks
- ⚡ Optimized batching for fast scans
- 🔐 Supports both authenticated (Socket org) and free modes
- 🎯 Native integration with Bun's security provider API
bun add -d @socketsecurity/bun-security-scannerAdd to your bunfig.toml:
[install.security]
scanner = "@socketsecurity/bun-security-scanner"For enhanced scanning with your Socket organization settings, set the SOCKET_API_TOKEN environment variable:
export SOCKET_API_TOKEN="xyz"
bun installNote
The token needs the packages scope. The legacy SOCKET_API_KEY name is also read.
The scanner will automatically read your token from:
SOCKET_API_TOKENenvironment variable (or the legacySOCKET_API_KEY)- Socket CLI settings file (if available)
Without a token, the scanner runs in free mode using Socket's public API.
Contributor commands
pnpm install
pnpm run build
pnpm run check
pnpm run testMIT
