Add a trusted dependency

By default, Bun does not execute arbitrary lifecycle scripts for installed dependencies, such as postinstall and node-gyp builds. These scripts represent a potential security risk, as they can execute arbitrary code on your machine.

If you see one of the following errors, you are probably using a package that needs its postinstall script to work:

error: could not determine executable to run for package
ENOEXEC (Exec format error)

To allow Bun to execute lifecycle scripts for a specific package, add the package to trustedDependencies in your package.json. You can do this automatically by running bun pm trust <pkg>.

package.json

{
  "name": "my-app",
  "version": "1.0.0",
  "trustedDependencies": ["my-trusted-package"] // [!code ++]
}

Once you add the package to trustedDependencies, run a fresh install. Bun re-installs your dependencies and runs the package's lifecycle scripts. (bun pm trust runs them immediately, so you can skip the extra install.)

terminal

rm -rf node_modules
bun install

See trusted dependencies.