What causes "EmptyPackageField" in oven-sh/bun?

Skip advisories with no package name at the source: if (!adv.package) continue;

oven-sh/bun · error · bun_install::Error

EmptyPackageField

Error message

EmptyPackageField

What it means

The advisory's `package` field is a string but empty (security_scanner.rs:1840-1845). An advisory that names no package cannot be correlated with installed dependencies, so it is rejected; the failing index is printed.

Source

Thrown at src/install/error.rs:133

    #[error("ScannerFailed")]
    ScannerFailed,
    #[error("UnknownMessageType")]
    UnknownMessageType,
    #[error("MissingAdvisoriesField")]
    MissingAdvisoriesField,
    #[error("SecurityScannerFailed")]
    SecurityScannerFailed,
    #[error("SecurityScannerTerminated")]
    SecurityScannerTerminated,
    #[error("InvalidAdvisoriesFormat")]
    InvalidAdvisoriesFormat,
    #[error("InvalidAdvisoryFormat")]
    InvalidAdvisoryFormat,
    #[error("MissingPackageField")]
    MissingPackageField,
    #[error("InvalidPackageField")]
    InvalidPackageField,
    #[error("EmptyPackageField")]
    EmptyPackageField,
    #[error("InvalidDescriptionField")]
    InvalidDescriptionField,
    #[error("InvalidUrlField")]
    InvalidUrlField,
    #[error("MissingLevelField")]
    MissingLevelField,
    #[error("InvalidLevelField")]
    InvalidLevelField,
    #[error("InvalidLevelValue")]
    InvalidLevelValue,
    #[error("Missing global bin directory: try setting $BUN_INSTALL")]
    MissingGlobalBinDirectoryTrySettingBUNINSTALL,
    #[error("InvalidURL")]
    InvalidURL,
    #[error("Fail")]
    Fail,
    #[error("IntegrityCheckFailed")]

View on GitHub (pinned to 8c5296ac45)

Solutions

Skip advisories with no package name at the source: if (!adv.package) continue;
Fix the code path that produces nameless advisories — usually an undefined variable or missed mapping
Log dropped advisories during scanner development so silent gaps are visible

Example fix

// before
results.push({ package: pkg?.name ?? "", level }); // may push empty

// after
if (pkg?.name) results.push({ package: pkg.name, level });

Defensive patterns

Strategy: validation

Validate before calling

// scanner-side: never emit empty package names
const advisories = raw.filter((a) => typeof a.package === "string" && a.package.trim() !== "");

Type guard

const hasNonEmptyPackage = (a) => typeof a?.package === "string" && a.package.trim().length > 0;

Prevention

Skip nameless advisories at creation time instead of sending placeholders
Warn when an advisory is dropped so data gaps are visible during development
Guard against undefined name variables defaulting to "" via ?? checks

When it happens

Trigger: Scanner constructs advisories from templated/default objects where the package name never got filled in — e.g. a loop variable that was undefined and stringified to "", or filtering logic that keeps placeholder entries.

Common situations: Placeholder advisory records; a bug where the advisory is created before the package name is known; metacharacter-only values after trimming.

Related errors

AI-assisted analysis of oven-sh/bun@8c5296ac45 (2026-08-16). Data as JSON: /api/errors/1b9180e40d6e4c3c. Report an issue: GitHub.