Add a trusted dependency
Unlike other npm clients, Bun does not execute arbitrary lifecycle scripts for installed dependencies, such as postinstall and node-gyp builds. These scripts represent a potential security risk, as they can execute arbitrary code on your machine.
Bun includes a default allowlist of popular packages whose postinstall scripts are known to be safe; see the full
list. It only applies to
packages installed from npm. For packages from other sources (such as file:, link:, git:, or github:
dependencies), you must explicitly add them to trustedDependencies.
If you see one of the following errors, you are probably using a package that needs its postinstall script to work:
error: could not determine executable to run for packageInvalidExe
To allow Bun to execute lifecycle scripts for a specific package, add the package to trustedDependencies in your package.json. You can do this automatically by running bun pm trust <pkg>.
This only allows lifecycle scripts for the specific package listed in trustedDependencies, not the dependencies of
that dependency.
{
"name": "my-app",
"version": "1.0.0",
"trustedDependencies": ["my-trusted-package"]
}Once this is added, run a fresh install. Bun re-installs your dependencies and runs the package's lifecycle scripts.
$ rm -rf node_modules
$ rm bun.lock
$ bun installSee trusted dependencies.