Skip to content

README.md

Latest commit

 

History

History
85 lines (57 loc) · 2.93 KB

README.md

File metadata and controls

85 lines (57 loc) · 2.93 KB
Raw

bun-security-scanner Socket Bun Security Scanner

Socket Badge Coverage

Follow @SocketSecurity Follow @socket.dev on Bluesky

Official Socket Security scanner for Bun's package installation process. Protects your projects from malicious packages, typosquatting, and other supply chain attacks.

Bun's package installer exposes a security-provider API that lets a scanner vet every package before it is installed. This repo is Socket's implementation of that provider: it checks each package against Socket's threat intelligence during bun install, blocking malware, typosquats, and other supply-chain attacks before they reach your machine. It runs with no configuration in free mode, and applies your Socket organization's policy when a token is present.

Features

  • 🛡️ Real-time security scanning during package installation
  • 🔍 Detects malware, typosquatting, and supply chain attacks
  • ⚡ Optimized batching for fast scans
  • 🔐 Supports both authenticated (Socket org) and free modes
  • 🎯 Native integration with Bun's security provider API

Install

bun add -d @socketsecurity/bun-security-scanner

Usage

Add to your bunfig.toml:

[install.security]
scanner = "@socketsecurity/bun-security-scanner"

Authentication (Optional)

For enhanced scanning with your Socket organization settings, set the SOCKET_API_TOKEN environment variable:

export SOCKET_API_TOKEN="xyz"

bun install

Note

The token needs the packages scope. The legacy SOCKET_API_KEY name is also read.

The scanner will automatically read your token from:

  1. SOCKET_API_TOKEN environment variable (or the legacy SOCKET_API_KEY)
  2. Socket CLI settings file (if available)

Without a token, the scanner runs in free mode using Socket's public API.

Development

Contributor commands 
pnpm install
pnpm run build
pnpm run check
pnpm run test

Support

License

MIT