oven-sh/bun · error · bun_install::Error

MissingPackageField

Error message

MissingPackageField

What it means

An advisory object inside the `advisories` array is missing the required `package` field (security_scanner.rs:1826-1831). Every advisory must name the affected package so Bun can map it to a lockfile entry; the failing index is printed.

Source

Thrown at src/install/error.rs:129

    #[error("SecurityScannerNotInDependencies")]
    SecurityScannerNotInDependencies,
    #[error("InvalidScannerVersion")]
    InvalidScannerVersion,
    #[error("ScannerFailed")]
    ScannerFailed,
    #[error("UnknownMessageType")]
    UnknownMessageType,
    #[error("MissingAdvisoriesField")]
    MissingAdvisoriesField,
    #[error("SecurityScannerFailed")]
    SecurityScannerFailed,
    #[error("SecurityScannerTerminated")]
    SecurityScannerTerminated,
    #[error("InvalidAdvisoriesFormat")]
    InvalidAdvisoriesFormat,
    #[error("InvalidAdvisoryFormat")]
    InvalidAdvisoryFormat,
    #[error("MissingPackageField")]
    MissingPackageField,
    #[error("InvalidPackageField")]
    InvalidPackageField,
    #[error("EmptyPackageField")]
    EmptyPackageField,
    #[error("InvalidDescriptionField")]
    InvalidDescriptionField,
    #[error("InvalidUrlField")]
    InvalidUrlField,
    #[error("MissingLevelField")]
    MissingLevelField,
    #[error("InvalidLevelField")]
    InvalidLevelField,
    #[error("InvalidLevelValue")]
    InvalidLevelValue,
    #[error("Missing global bin directory: try setting $BUN_INSTALL")]
    MissingGlobalBinDirectoryTrySettingBUNINSTALL,
    #[error("InvalidURL")]

View on GitHub (pinned to 8c5296ac45)

Solutions

1. Add the exact key "package" with the affected package's name as a string to every advisory object
2. Rename 'name'/'module_name'/'moduleName' fields to "package" when adapting foreign formats
3. Add a unit check in the scanner that every advisory has a truthy package value before sending

Example fix

// before
advisories: [{ level: "warn", description: "RCE in foo" }]

// after
advisories: [{ package: "foo", level: "warn", description: "RCE in foo" }]

// scanner-side: filter advisories lacking a package before sending
const advisories = raw.filter((a) => "package" in a && typeof a.package === "string" && a.package !== "");

const hasPackageField = (a) => typeof a?.package === "string" && a.package.length > 0;

When it happens

Trigger: Scanner emits {"level":"warn","description":"..."} without a package key, or names it differently ("name", "moduleName", "pkg").

Common situations: Field-name guesses in custom scanners (npm audit uses "module_name"); copying advisory objects from another tool's JSON without renaming keys.

Related errors

• InvalidAdvisoriesFormat
• InvalidAdvisoryFormat
• MissingAdvisoriesField
• InvalidPackageField
• EmptyPackageField

AI-assisted analysis of oven-sh/bun@8c5296ac45 (2026-08-16). Data as JSON: /api/errors/b6671f80159ef859. Report an issue: GitHub.