Post

Reporting the same security issue to pnpm vs bun: pnpm acknowledged it quickly, shipped a fix, backported it, and published an advisory. bun never acknowledged, silently fixed this and another issue I reported, has not published advisories. One takes security more seriously.

Emanuele (Ema)

@ematipico.xyz

26 May

Maybe they don't deem it a security issue, but just a bug

David Sherret

@dsherret.dev

I was wondering that, but one of the issues I reported was that https dependencies didn’t store a checksum in the lock file. It would be possible to serve a different package to someone running bun install from a data centre ip with a bun user agent for example (ex. on deployment)

26/5/26, 11:40 am0 reposts2 likes

No replies yet.