Socket Bun Security Scanner

Official Socket Security scanner for Bun's package installation process. Protects your projects from malicious packages, typosquatting, and other supply chain attacks.

Bun's package installer exposes a security-provider API that lets a scanner vet every package before it is installed. This repo is Socket's implementation of that provider: it checks each package against Socket's threat intelligence during bun install, blocking malware, typosquats, and other supply-chain attacks before they reach your machine. It runs with no configuration in free mode, and applies your Socket organization's policy when a token is present.

Features

• 🛡️ Real-time security scanning during package installation
• 🔍 Detects malware, typosquatting, and supply chain attacks
• ⚡ Optimized batching for fast scans
• 🔐 Supports both authenticated (Socket org) and free modes
• 🎯 Native integration with Bun's security provider API

Install

bun add -d @socketsecurity/bun-security-scanner

Usage

Add to your bunfig.toml:

[install.security]
scanner = "@socketsecurity/bun-security-scanner"

Authentication (Optional)

For enhanced scanning with your Socket organization settings, set the SOCKET_API_TOKEN environment variable:

export SOCKET_API_TOKEN="xyz"

bun install

[!NOTE] The token needs the packages scope. The legacy SOCKET_API_KEY name is also read.

The scanner will automatically read your token from:

1. SOCKET_API_TOKEN environment variable (or the legacy SOCKET_API_KEY)
2. Socket CLI settings file (if available)

Without a token, the scanner runs in free mode using Socket's public API.

Development

pnpm install
pnpm run build
pnpm run check
pnpm run test

Support

• Socket Documentation
• Bun Security Scanner API
• Report Issues

License

MIT