oven-sh/bun · error · Error

scanner.scan is not a function, got ${typeof scanner.scan}

Error message

scanner.scan is not a function, got ${typeof scanner.scan}

What it means

The imported scanner object passed the shape and version checks, but `typeof scanner.scan !== "function"`. The thrown message includes the actual type ("scanner.scan is not a function, got undefined") and is reported as SCAN_FAILED.

Source

Thrown at src/install/PackageManager/scanner-entry.ts:100

    });
  }
}

try {
  if (typeof scanner !== "object" || scanner === null || typeof scanner.version !== "string") {
    throw new Error("Security scanner must export a 'scanner' object with a version property");
  }

  if (scanner.version !== "1") {
    sendAndExit({
      type: "error",
      code: "INVALID_VERSION",
      message: `Security scanner must be version 1, got version ${scanner.version}`,
    });
  }

  if (typeof scanner.scan !== "function") {
    throw new Error(`scanner.scan is not a function, got ${typeof scanner.scan}`);
  }

  const result = await scanner.scan({ packages });

  if (!Array.isArray(result)) {
    throw new Error("Security scanner must return an array of advisories");
  }

  sendAndExit({ type: "result", advisories: result });
} catch (error) {
  if (!suppressError) {
    console.error(error);
  }

  sendAndExit({
    type: "error",
    code: "SCAN_FAILED",
    message: error instanceof Error ? error.message : "Unknown error occurred",

View on GitHub (pinned to 8c5296ac45)

Solutions

1. Name the method exactly `scan` on the exported scanner object
2. Inspect what actually shipped: bun -e 'import("m").then(m => console.log(typeof m.scanner.scan))'
3. Pin the scanner version whose contract you implemented

Example fix

// before
export const scanner = { version: "1", scanPackages: async ({ packages }) => [] };

// after
export const scanner = { version: "1", scan: async ({ packages }) => [] };

const { scanner } = await import("@corp/scanner");
if (typeof scanner.scan !== "function") {
  throw new Error(`scanner.scan is ${typeof scanner.scan}; expected a function`);
}

function hasScan(s: unknown): s is { scan: (input: { packages: unknown[] }) => Promise<unknown[]> } {
  return typeof (s as { scan?: unknown })?.scan === "function";
}

When it happens

Trigger: The method is named scanPackages/run/audit instead of scan; scan exists on the default export but not on the named `scanner` object; scan is defined as a non-function property (string, boolean, object).

Common situations: API renamed in a scanner update; partial refactor leaving scan on a nested object; implementation copied from a different scanner version's docs.

Related errors

• Security scanner must export a 'scanner' object with a versi
• INVALID_VERSION
• Security scanner must return an array of advisories
• MODULE_NOT_FOUND
• SecurityScannerNotFound

AI-assisted analysis of oven-sh/bun@8c5296ac45 (2026-08-16). Data as JSON: /api/errors/9b6451f6bede8499. Report an issue: GitHub.