Skip to main content
By default, Bun does not execute arbitrary lifecycle scripts for installed dependencies, such as postinstall and node-gyp builds. These scripts represent a potential security risk, as they can execute arbitrary code on your machine.
Bun includes a default allowlist of popular packages whose postinstall scripts are known to be safe. See the full list. The allowlist only applies to packages installed from npm. For packages from other sources (such as file:, link:, git:, or github: dependencies), you must explicitly add them to trustedDependencies. Defining trustedDependencies in your package.json replaces this default list rather than extending it, so also list any packages from the default list whose lifecycle scripts you still need.
If you see one of the following errors, you are probably using a package that needs its postinstall script to work:
  • error: could not determine executable to run for package
  • ENOEXEC (Exec format error)
To allow Bun to execute lifecycle scripts for a specific package, add the package to trustedDependencies in your package.json. You can do this automatically by running bun pm trust <pkg>.
Listing a package in trustedDependencies only allows lifecycle scripts for that specific package, not the dependencies of that dependency.
package.json
Once you add the package to trustedDependencies, run a fresh install. Bun re-installs your dependencies and runs the package’s lifecycle scripts. (bun pm trust runs them immediately, so you can skip the extra install.)
terminal
See trusted dependencies.