{"record":{"id":"1b9180e40d6e4c3c","repo":"oven-sh/bun","slug":"emptypackagefield","errorCode":null,"errorMessage":"EmptyPackageField","messagePattern":"EmptyPackageField","errorType":"exception","errorClass":"bun_install::Error","httpStatus":null,"severity":"error","filePath":"src/install/error.rs","lineNumber":133,"sourceCode":"    #[error(\"ScannerFailed\")]\n    ScannerFailed,\n    #[error(\"UnknownMessageType\")]\n    UnknownMessageType,\n    #[error(\"MissingAdvisoriesField\")]\n    MissingAdvisoriesField,\n    #[error(\"SecurityScannerFailed\")]\n    SecurityScannerFailed,\n    #[error(\"SecurityScannerTerminated\")]\n    SecurityScannerTerminated,\n    #[error(\"InvalidAdvisoriesFormat\")]\n    InvalidAdvisoriesFormat,\n    #[error(\"InvalidAdvisoryFormat\")]\n    InvalidAdvisoryFormat,\n    #[error(\"MissingPackageField\")]\n    MissingPackageField,\n    #[error(\"InvalidPackageField\")]\n    InvalidPackageField,\n    #[error(\"EmptyPackageField\")]\n    EmptyPackageField,\n    #[error(\"InvalidDescriptionField\")]\n    InvalidDescriptionField,\n    #[error(\"InvalidUrlField\")]\n    InvalidUrlField,\n    #[error(\"MissingLevelField\")]\n    MissingLevelField,\n    #[error(\"InvalidLevelField\")]\n    InvalidLevelField,\n    #[error(\"InvalidLevelValue\")]\n    InvalidLevelValue,\n    #[error(\"Missing global bin directory: try setting $BUN_INSTALL\")]\n    MissingGlobalBinDirectoryTrySettingBUNINSTALL,\n    #[error(\"InvalidURL\")]\n    InvalidURL,\n    #[error(\"Fail\")]\n    Fail,\n    #[error(\"IntegrityCheckFailed\")]","sourceCodeStart":115,"sourceCodeEnd":151,"githubUrl":"https://github.com/oven-sh/bun/blob/8c5296ac459e8252d3cd702f3fbcbb0c249d95d5/src/install/error.rs#L115-L151","documentation":"The advisory's `package` field is a string but empty (security_scanner.rs:1840-1845). An advisory that names no package cannot be correlated with installed dependencies, so it is rejected; the failing index is printed.","triggerScenarios":"Scanner constructs advisories from templated/default objects where the package name never got filled in — e.g. a loop variable that was undefined and stringified to \"\", or filtering logic that keeps placeholder entries.","commonSituations":"Placeholder advisory records; a bug where the advisory is created before the package name is known; metacharacter-only values after trimming.","solutions":["Skip advisories with no package name at the source: if (!adv.package) continue;","Fix the code path that produces nameless advisories — usually an undefined variable or missed mapping","Log dropped advisories during scanner development so silent gaps are visible"],"exampleFix":"// before\nresults.push({ package: pkg?.name ?? \"\", level }); // may push empty\n\n// after\nif (pkg?.name) results.push({ package: pkg.name, level });","handlingStrategy":"validation","validationCode":"// scanner-side: never emit empty package names\nconst advisories = raw.filter((a) => typeof a.package === \"string\" && a.package.trim() !== \"\");","typeGuard":"const hasNonEmptyPackage = (a) => typeof a?.package === \"string\" && a.package.trim().length > 0;","tryCatchPattern":null,"preventionTips":["Skip nameless advisories at creation time instead of sending placeholders","Warn when an advisory is dropped so data gaps are visible during development","Guard against undefined name variables defaulting to \"\" via ?? checks"],"tags":["security-scanner","json","schema","validation"],"backgroundTag":null,"analyzedSha":"8c5296ac459e8252d3cd702f3fbcbb0c249d95d5","analyzedAt":"2026-08-16T08:01:58.794Z","schemaVersion":2},"datasetVersion":"2026-08-16T08:17:34.114Z"}