{"record":{"id":"d13b6787fa6c8dc9","repo":"oven-sh/bun","slug":"invalidpackagefield","errorCode":null,"errorMessage":"InvalidPackageField","messagePattern":"InvalidPackageField","errorType":"exception","errorClass":"bun_install::Error","httpStatus":null,"severity":"error","filePath":"src/install/error.rs","lineNumber":131,"sourceCode":"    #[error(\"InvalidScannerVersion\")]\n    InvalidScannerVersion,\n    #[error(\"ScannerFailed\")]\n    ScannerFailed,\n    #[error(\"UnknownMessageType\")]\n    UnknownMessageType,\n    #[error(\"MissingAdvisoriesField\")]\n    MissingAdvisoriesField,\n    #[error(\"SecurityScannerFailed\")]\n    SecurityScannerFailed,\n    #[error(\"SecurityScannerTerminated\")]\n    SecurityScannerTerminated,\n    #[error(\"InvalidAdvisoriesFormat\")]\n    InvalidAdvisoriesFormat,\n    #[error(\"InvalidAdvisoryFormat\")]\n    InvalidAdvisoryFormat,\n    #[error(\"MissingPackageField\")]\n    MissingPackageField,\n    #[error(\"InvalidPackageField\")]\n    InvalidPackageField,\n    #[error(\"EmptyPackageField\")]\n    EmptyPackageField,\n    #[error(\"InvalidDescriptionField\")]\n    InvalidDescriptionField,\n    #[error(\"InvalidUrlField\")]\n    InvalidUrlField,\n    #[error(\"MissingLevelField\")]\n    MissingLevelField,\n    #[error(\"InvalidLevelField\")]\n    InvalidLevelField,\n    #[error(\"InvalidLevelValue\")]\n    InvalidLevelValue,\n    #[error(\"Missing global bin directory: try setting $BUN_INSTALL\")]\n    MissingGlobalBinDirectoryTrySettingBUNINSTALL,\n    #[error(\"InvalidURL\")]\n    InvalidURL,\n    #[error(\"Fail\")]","sourceCodeStart":113,"sourceCodeEnd":149,"githubUrl":"https://github.com/oven-sh/bun/blob/8c5296ac459e8252d3cd702f3fbcbb0c249d95d5/src/install/error.rs#L113-L149","documentation":"The advisory's `package` field exists but is not a string (security_scanner.rs:1833-1838) — e.g. a number, object, or nested array. The field must be a UTF-8 string literal; the failing index is printed.","triggerScenarios":"Scanner sends \"package\": {\"name\":\"foo\",\"version\":\"1.0.0\"} or a package ID number instead of the plain name string.","commonSituations":"Structured package objects from internal scanner models serialized verbatim; version-scoped keys; porting advisories from tools that nest name/version.","solutions":["Flatten to a plain string: \"package\": \"foo\" (optionally scoped \"@scope/foo\")","Extract the name field from nested objects before serialization","Keep version info in `description` or `url` — the schema has no version slot"],"exampleFix":"// before\nadvisories: [{ package: { name: \"foo\", version: \"1.2.3\" }, level: \"fatal\" }]\n\n// after\nadvisories: [{ package: \"foo\", level: \"fatal\", description: \"affects <=1.2.3\" }]","handlingStrategy":"type-guard","validationCode":"// scanner-side: flatten structured package values before sending\nfor (const a of advisories) if (typeof a.package !== \"string\") a.package = a.package?.name ?? a.package?.id;","typeGuard":"const hasStringPackage = (a) => typeof a?.package === \"string\";","tryCatchPattern":null,"preventionTips":["Send the bare package name string; keep version details in description","Destructure nested {name, version} objects at the adapter boundary","Never pass package IDs or numeric identifiers in the package slot"],"tags":["security-scanner","json","schema","type-mismatch"],"backgroundTag":null,"analyzedSha":"8c5296ac459e8252d3cd702f3fbcbb0c249d95d5","analyzedAt":"2026-08-16T08:01:58.794Z","schemaVersion":2},"datasetVersion":"2026-08-16T08:17:34.114Z"}