Skip to main content
Packages on npm can define lifecycle scripts in their package.json — shell commands the package manager runs at specific points during installation or removal. Common lifecycle scripts:
ScriptWhen it runs
preinstallBefore the package is installed
installDuring installation
postinstallAfter the package is installed
preuninstallBefore the package is uninstalled
prepublishOnlyBefore the package is published
prepareAfter install and before publish

​
Bun’s security model

Unlike npm, yarn, and pnpm, Bun does not run lifecycle scripts for installed dependencies by default. Arbitrary scripts executed silently during installation represent a supply chain attack vector. Instead, Bun uses a “default-secure” approach: scripts only run for packages you have explicitly trusted.

​
Your own project’s scripts

Lifecycle scripts defined in your own package.json (the root package) always run. Only scripts belonging to installed dependencies are blocked by default. 
{
  "name": "my-app",
  "scripts": {
    "postinstall": "node scripts/setup.js"
  }
}

​
Trusting a dependency’s lifecycle scripts

Add the package name to trustedDependencies in your root package.json, then reinstall: 
{
  "name": "my-app",
  "trustedDependencies": ["node-sass", "esbuild"]
}

bun install
Bun will now run postinstall (and other lifecycle scripts) for node-sass and esbuild.

​
Default trusted packages

The top 500 npm packages that commonly require lifecycle scripts (such as esbuild, sharp, node-sass, @swc/core) are trusted automatically. You can view the full list on GitHub.
The default trusted list applies only to packages installed from npm. Packages from file:, link:, git:, or github: sources must be explicitly added to trustedDependencies, even if the package name appears on the default list.

​
Viewing blocked scripts

To see which installed packages had their lifecycle scripts blocked: 
bun pm untrusted

./node_modules/@biomejs/biome @1.8.3
 » [postinstall]: node scripts/postinstall.js

These dependencies had their lifecycle scripts blocked during install.

​
Trusting packages interactively

To run blocked scripts and add the package to trustedDependencies in one step: 
bun pm trust @biomejs/biome
bun pm trust --all   # trust all currently untrusted packages

​
Disabling all lifecycle scripts

To skip lifecycle scripts for every package, including trusted ones: 
bun install --ignore-scripts

​
Concurrent scripts

Lifecycle scripts run in parallel during installation. The default concurrency is two times the reported CPU count (or GOMAXPROCS). To adjust: 
bun install --concurrent-scripts 5
Or configure in bunfig.toml: 
[install]
concurrentScripts = 8

Build docs developers (and LLMs) love

Get started for freeTalk to us