{"record":{"id":"0c30c0be033e84d5","repo":"oven-sh/bun","slug":"module-not-found","errorCode":"MODULE_NOT_FOUND","errorMessage":"Failed to import security scanner: '${scannerModuleName}'","messagePattern":"Failed to import security scanner: '(.+?)'","errorType":"error_code","errorClass":null,"httpStatus":null,"severity":"error","filePath":"src/install/PackageManager/scanner-entry.ts","lineNumber":74,"sourceCode":"    code: \"SCAN_FAILED\",\n    message,\n  });\n}\n\nlet scanner: Bun.Security.Scanner;\n\ntry {\n  scanner = (await import(scannerModuleName)).scanner;\n} catch (error) {\n  if (typeof error === \"object\" && error !== null && \"code\" in error && error.code === \"ERR_MODULE_NOT_FOUND\") {\n    if (!suppressError) {\n      const msg = `\\x1b[31merror: \\x1b[0mFailed to import security scanner: \\x1b[1m'${scannerModuleName}'`;\n      console.error(msg);\n    }\n\n    sendAndExit({\n      type: \"error\",\n      code: \"MODULE_NOT_FOUND\",\n      module: scannerModuleName,\n    });\n  } else {\n    sendAndExit({\n      type: \"error\",\n      code: \"SCAN_FAILED\",\n      message: error instanceof Error ? error.message : String(error),\n    });\n  }\n}\n\ntry {\n  if (typeof scanner !== \"object\" || scanner === null || typeof scanner.version !== \"string\") {\n    throw new Error(\"Security scanner must export a 'scanner' object with a version property\");\n  }\n\n  if (scanner.version !== \"1\") {\n    sendAndExit({","sourceCodeStart":56,"sourceCodeEnd":92,"githubUrl":"https://github.com/oven-sh/bun/blob/8c5296ac459e8252d3cd702f3fbcbb0c249d95d5/src/install/PackageManager/scanner-entry.ts#L56-L92","documentation":"Bun's installer runs a post-install security scan by spawning a subprocess whose generated entry does `await import(scannerModuleName)`; the module name comes from `[install.security] scanner = \"...\"` in bunfig.toml, substituted for the `__SCANNER_MODULE__` placeholder. This error means the dynamic import rejected with ERR_MODULE_NOT_FOUND: the configured scanner module cannot be resolved from the project. The child writes {type:\"error\", code:\"MODULE_NOT_FOUND\", module} to the IPC pipe (fd 3), prints a red \"Failed to import security scanner\" line (suppressed unless log level is verbose), and exits 1.","triggerScenarios":"Running `bun install` / `bun update` with `[install.security] scanner = \"@corp/scanner\"` where that package is not resolvable from the project root: not listed in package.json dependencies, absent from node_modules, or the name is misspelled. The parent substitutes the configured name into the entry source, so any unresolvable name lands in this branch.","commonSituations":"bunfig.toml committed with a scanner name but the package was never added as a dependency; scanner pruned by a production-mode install; partially deleted node_modules; typo in a scoped package name; teammate cloned the repo without installing the scanner package.","solutions":["Verify the exact module name in bunfig.toml [install.security] scanner matches the dependency name","Add the scanner package to package.json dependencies and run bun install again","Confirm it is on disk: ls node_modules/<scanner-name>","Re-run with --verbose to see the unsuppressed import error output","If security scanning is not intended, remove the [install.security] block from bunfig.toml"],"exampleFix":"# before (bunfig.toml)\n[install.security]\nscanner = \"@corp/sec-scaner\"\n\n# after\n[install.security]\nscanner = \"@corp/sec-scanner\"\n\n# then make it resolvable\nbun add @corp/sec-scanner","handlingStrategy":"validation","validationCode":"import { Bun } from \"bun\";\n\nconst scannerName = \"@corp/sec-scanner\"; // must match bunfig.toml [install.security] scanner\ntry {\n  Bun.resolveSync(scannerName, import.meta.dir);\n} catch {\n  console.error(`scanner \"${scannerName}\" is not installed; run: bun add ${scannerName}`);\n  process.exit(1);\n}","typeGuard":null,"tryCatchPattern":"// when consuming the scanner subprocess IPC protocol directly\nconst msg = JSON.parse(ipcOutput);\nif (msg.type === \"error\" && msg.code === \"MODULE_NOT_FOUND\") {\n  throw new Error(`Security scanner ${msg.module} is missing from dependencies`);\n}","preventionTips":["Keep the scanner in package.json dependencies, not just on one machine","Add a CI step that resolves the bunfig scanner name before install","Change the scanner name and its dependency in the same commit"],"tags":["install","bunfig","security-scanner","module-resolution"],"backgroundTag":null,"analyzedSha":"8c5296ac459e8252d3cd702f3fbcbb0c249d95d5","analyzedAt":"2026-08-16T08:01:58.794Z","schemaVersion":2},"datasetVersion":"2026-08-16T08:17:34.114Z"}