Trust dependency scripts deliberately

An npm package can define lifecycle scripts such as postinstall. These scripts run commands on your machine during installation.

That power is useful. Native packages may need to download or build a platform-specific binary. It is also a security boundary.

Bun does not run arbitrary dependency lifecycle scripts by default. If a package needs one, Bun reports that the script was blocked.

List packages with blocked scripts:

bun pm untrusted

Before trusting one, inspect why the package needs the script. Check its package metadata, source, and documentation.

Then trust the specific package:

bun pm trust package-name

Bun runs its blocked scripts and records the package in trustedDependencies inside package.json.

You can also trust a package while adding it:

bun add --trust package-name

Keep the approval narrow

Avoid this command in a project you have not audited:

bun pm trust --all

It approves every currently blocked dependency script. That removes the useful review boundary Bun created.

Commit changes to trustedDependencies. The approval is part of the project’s dependency policy, not a private setting on your laptop.

If a package works without its blocked script, leave it blocked. If it fails, investigate the exact requirement before granting more access.