oven-sh/bun · error · bun_install::Error

SecurityScannerNotFound

Error message

SecurityScannerNotFound

What it means

Bun's package manager could not load the security scanner configured via `security_scanner` in the `[install]` section of bunfig.toml. The scanner subprocess itself reported MODULE_NOT_FOUND on a retry attempt after Bun already tried to install it. Because the module still cannot be resolved after installation, the install-time security scan aborts.

Source

Thrown at src/install/error.rs:109

    #[error("SecurityScannerProcessFailedWithoutExitStatus")]
    SecurityScannerProcessFailedWithoutExitStatus,
    #[error("NoSecurityScanData")]
    NoSecurityScanData,
    #[error("InvalidIPCMessage")]
    InvalidIPCMessage,
    #[error("InvalidIPCFormat")]
    InvalidIPCFormat,
    #[error("MissingIPCType")]
    MissingIPCType,
    #[error("InvalidIPCType")]
    InvalidIPCType,
    #[error("MissingErrorCode")]
    MissingErrorCode,
    #[error("InvalidErrorCode")]
    InvalidErrorCode,
    #[error("UnknownErrorCode")]
    UnknownErrorCode,
    #[error("SecurityScannerNotFound")]
    SecurityScannerNotFound,
    #[error("SecurityScannerNotInDependencies")]
    SecurityScannerNotInDependencies,
    #[error("InvalidScannerVersion")]
    InvalidScannerVersion,
    #[error("ScannerFailed")]
    ScannerFailed,
    #[error("UnknownMessageType")]
    UnknownMessageType,
    #[error("MissingAdvisoriesField")]
    MissingAdvisoriesField,
    #[error("SecurityScannerFailed")]
    SecurityScannerFailed,
    #[error("SecurityScannerTerminated")]
    SecurityScannerTerminated,
    #[error("InvalidAdvisoriesFormat")]
    InvalidAdvisoriesFormat,
    #[error("InvalidAdvisoryFormat")]

View on GitHub (pinned to 8c5296ac45)

Solutions

1. Verify the scanner value in bunfig.toml: for a file, confirm the path exists (ls <path>); for a package, confirm the name is published and spelled correctly
2. Run `bun add --dev <scanner-package>` explicitly and check it resolves (`bunx <scanner-package> --help` or require it from a script)
3. Delete node_modules and bun.lock, then re-run `bun install` to rebuild a clean install of the scanner
4. If the install itself failed, fix the underlying install error (registry auth, network, lockfile) before re-running with the scanner enabled

Example fix

# before (bunfig.toml)
[install]
security_scanner = "./tools/scanner.js"   # file was moved

# after
[install]
security_scanner = "./scripts/security-scanner.js"  # corrected existing path

# before running bun install, confirm the configured scanner resolves
SCANNER=$(grep -oP 'security_scanner\s*=\s*"\K[^"]+' bunfig.toml)
if [ -n "$SCANNER" ]; then
  if [ -f "$SCANNER" ]; then : # local file exists
  elif grep -q "\"$SCANNER\"" package.json; then : # declared dependency
  else echo "scanner '$SCANNER' missing: add it or fix the path" >&2; exit 1; fi
fi

# in CI scripts: fail fast with context instead of a raw Bun error
bun install || { echo "install failed — check security_scanner config in bunfig.toml" >&2; exit 1; }

When it happens

Trigger: Set `[install] security_scanner = "..."` in bunfig.toml, run `bun install`, Bun attempts a partial install of the scanner package, respawns it, and the scanner process again reports code MODULE_NOT_FOUND. Two branches: a package-name scanner that failed to install correctly (security_scanner.rs:1630), or a local file path that does not exist on disk (security_scanner.rs:1637).

Common situations: Typos in the scanner package name or file path in bunfig.toml; a local scanner script moved or deleted; a scoped npm scanner that installed into an isolated linker layout the scanner cannot resolve; corrupt node_modules after an interrupted install; private registry auth failure so the scanner never actually downloaded.

Related errors

• SecurityScannerNotInDependencies
• MODULE_NOT_FOUND
• InvalidScannerVersion
• ScannerFailed
• SecurityScannerFailed

AI-assisted analysis of oven-sh/bun@8c5296ac45 (2026-08-16). Data as JSON: /api/errors/1ccc1c9fcef57ee2. Report an issue: GitHub.