Trust dependency scripts deliberately

An npm package can define lifecycle scripts, such as postinstall. These are commands the package asks your package manager to run on your machine, during installation, with your user’s permissions.

That power is useful. A package with native code may need to download or build a platform-specific binary right after install. But think about what it means. Installing a package runs someone else’s shell command on your laptop. Every dependency, and every dependency of a dependency, gets that chance. This is one of the most common ways malicious packages do damage.

Bun does not run arbitrary dependency lifecycle scripts by default. If a package needs one, Bun installs the files but skips the script, and reports that it was blocked.

Bun ships with a short list of popular packages whose scripts are allowed out of the box. You can see it with:

bun pm default-trusted

For everything else, you decide. List the packages with blocked scripts in your project:

bun pm untrusted

Before trusting one, find out why the package needs the script. Open its package.json on npm, read the postinstall command, and look at the source it calls. Most of the time it’s a binary download, and you can see exactly where from.

Then trust that specific package:

bun pm trust package-name

Bun runs its blocked scripts and records the package in trustedDependencies inside package.json.

You can also trust a package while adding it:

bun add --trust package-name

How a blocked script shows up

Often you don’t notice a blocked script at install time. You notice it later. You import the package, and it throws an error saying a native binding or a downloaded file is missing. The script that was supposed to fetch it never ran.

When that happens, run bun pm untrusted, confirm the package is on the list, read its script, and trust it. Don’t guess.

Keep the approval narrow

Avoid this command in a project you have not audited:

bun pm trust --all

It approves every currently blocked dependency script in one go. That throws away the review boundary Bun created for you.

Commit changes to trustedDependencies. The approval is part of the project’s dependency policy, and every teammate and every CI run should apply the same one. It is not a private setting on your laptop.

If a package works without its blocked script, leave it blocked. If it fails, investigate the exact requirement before granting more access.