oven-sh/bun · error

MODULE_NOT_FOUND

MODULE_NOT_FOUND

Error message

Failed to import security scanner: '${scannerModuleName}'

What it means

Bun's installer runs a post-install security scan by spawning a subprocess whose generated entry does `await import(scannerModuleName)`; the module name comes from `[install.security] scanner = "..."` in bunfig.toml, substituted for the `__SCANNER_MODULE__` placeholder. This error means the dynamic import rejected with ERR_MODULE_NOT_FOUND: the configured scanner module cannot be resolved from the project. The child writes {type:"error", code:"MODULE_NOT_FOUND", module} to the IPC pipe (fd 3), prints a red "Failed to import security scanner" line (suppressed unless log level is verbose), and exits 1.

Source

Thrown at src/install/PackageManager/scanner-entry.ts:74

    code: "SCAN_FAILED",
    message,
  });
}

let scanner: Bun.Security.Scanner;

try {
  scanner = (await import(scannerModuleName)).scanner;
} catch (error) {
  if (typeof error === "object" && error !== null && "code" in error && error.code === "ERR_MODULE_NOT_FOUND") {
    if (!suppressError) {
      const msg = `\x1b[31merror: \x1b[0mFailed to import security scanner: \x1b[1m'${scannerModuleName}'`;
      console.error(msg);
    }

    sendAndExit({
      type: "error",
      code: "MODULE_NOT_FOUND",
      module: scannerModuleName,
    });
  } else {
    sendAndExit({
      type: "error",
      code: "SCAN_FAILED",
      message: error instanceof Error ? error.message : String(error),
    });
  }
}

try {
  if (typeof scanner !== "object" || scanner === null || typeof scanner.version !== "string") {
    throw new Error("Security scanner must export a 'scanner' object with a version property");
  }

  if (scanner.version !== "1") {
    sendAndExit({

View on GitHub (pinned to 8c5296ac45)

Solutions

1. Verify the exact module name in bunfig.toml [install.security] scanner matches the dependency name
2. Add the scanner package to package.json dependencies and run bun install again
3. Confirm it is on disk: ls node_modules/<scanner-name>
4. Re-run with --verbose to see the unsuppressed import error output
5. If security scanning is not intended, remove the [install.security] block from bunfig.toml

Example fix

# before (bunfig.toml)
[install.security]
scanner = "@corp/sec-scaner"

# after
[install.security]
scanner = "@corp/sec-scanner"

# then make it resolvable
bun add @corp/sec-scanner

import { Bun } from "bun";

const scannerName = "@corp/sec-scanner"; // must match bunfig.toml [install.security] scanner
try {
  Bun.resolveSync(scannerName, import.meta.dir);
} catch {
  console.error(`scanner "${scannerName}" is not installed; run: bun add ${scannerName}`);
  process.exit(1);
}

// when consuming the scanner subprocess IPC protocol directly
const msg = JSON.parse(ipcOutput);
if (msg.type === "error" && msg.code === "MODULE_NOT_FOUND") {
  throw new Error(`Security scanner ${msg.module} is missing from dependencies`);
}

When it happens

Trigger: Running `bun install` / `bun update` with `[install.security] scanner = "@corp/scanner"` where that package is not resolvable from the project root: not listed in package.json dependencies, absent from node_modules, or the name is misspelled. The parent substitutes the configured name into the entry source, so any unresolvable name lands in this branch.

Common situations: bunfig.toml committed with a scanner name but the package was never added as a dependency; scanner pruned by a production-mode install; partially deleted node_modules; typo in a scoped package name; teammate cloned the repo without installing the scanner package.

Related errors

• SecurityScannerNotFound
• SecurityScannerNotInDependencies
• InvalidScannerVersion
• ScannerFailed
• SecurityScannerFailed

AI-assisted analysis of oven-sh/bun@8c5296ac45 (2026-08-16). Data as JSON: /api/errors/0c30c0be033e84d5. Report an issue: GitHub.