What causes "InvalidPackageField" in oven-sh/bun?

Flatten to a plain string: "package": "foo" (optionally scoped "@scope/foo")

oven-sh/bun · error · bun_install::Error

InvalidPackageField

Error message

InvalidPackageField

What it means

The advisory's `package` field exists but is not a string (security_scanner.rs:1833-1838) — e.g. a number, object, or nested array. The field must be a UTF-8 string literal; the failing index is printed.

Source

Thrown at src/install/error.rs:131

    #[error("InvalidScannerVersion")]
    InvalidScannerVersion,
    #[error("ScannerFailed")]
    ScannerFailed,
    #[error("UnknownMessageType")]
    UnknownMessageType,
    #[error("MissingAdvisoriesField")]
    MissingAdvisoriesField,
    #[error("SecurityScannerFailed")]
    SecurityScannerFailed,
    #[error("SecurityScannerTerminated")]
    SecurityScannerTerminated,
    #[error("InvalidAdvisoriesFormat")]
    InvalidAdvisoriesFormat,
    #[error("InvalidAdvisoryFormat")]
    InvalidAdvisoryFormat,
    #[error("MissingPackageField")]
    MissingPackageField,
    #[error("InvalidPackageField")]
    InvalidPackageField,
    #[error("EmptyPackageField")]
    EmptyPackageField,
    #[error("InvalidDescriptionField")]
    InvalidDescriptionField,
    #[error("InvalidUrlField")]
    InvalidUrlField,
    #[error("MissingLevelField")]
    MissingLevelField,
    #[error("InvalidLevelField")]
    InvalidLevelField,
    #[error("InvalidLevelValue")]
    InvalidLevelValue,
    #[error("Missing global bin directory: try setting $BUN_INSTALL")]
    MissingGlobalBinDirectoryTrySettingBUNINSTALL,
    #[error("InvalidURL")]
    InvalidURL,
    #[error("Fail")]

View on GitHub (pinned to 8c5296ac45)

Solutions

Flatten to a plain string: "package": "foo" (optionally scoped "@scope/foo")
Extract the name field from nested objects before serialization
Keep version info in `description` or `url` — the schema has no version slot

Example fix

// before
advisories: [{ package: { name: "foo", version: "1.2.3" }, level: "fatal" }]

// after
advisories: [{ package: "foo", level: "fatal", description: "affects <=1.2.3" }]

Defensive patterns

Strategy: type-guard

Validate before calling

// scanner-side: flatten structured package values before sending
for (const a of advisories) if (typeof a.package !== "string") a.package = a.package?.name ?? a.package?.id;

Type guard

const hasStringPackage = (a) => typeof a?.package === "string";

Prevention

Send the bare package name string; keep version details in description
Destructure nested {name, version} objects at the adapter boundary
Never pass package IDs or numeric identifiers in the package slot

When it happens

Trigger: Scanner sends "package": {"name":"foo","version":"1.0.0"} or a package ID number instead of the plain name string.

Common situations: Structured package objects from internal scanner models serialized verbatim; version-scoped keys; porting advisories from tools that nest name/version.

Related errors

AI-assisted analysis of oven-sh/bun@8c5296ac45 (2026-08-16). Data as JSON: /api/errors/d13b6787fa6c8dc9. Report an issue: GitHub.