Post

Reporting the same security issue to pnpm vs bun: pnpm acknowledged it quickly, shipped a fix, backported it, and published an advisory. bun never acknowledged, silently fixed this and another issue I reported, has not published advisories. One takes security more seriously.

25/5/26, 5:19 pm6 reposts112 likes

Luke

@lukeweston.bsky.social

26 May

I have no idea why Bun has so much more traction than Deno

Mastro.{js,ts}

@mastrojs.bsky.social

26 May

They had Node.js-compatibility first. The rest is all hype 🫠

Pop Tartarus

@jack-a-dandy.bsky.social

26 May

Why does this almost feel like one has an automated response process and protocol and the other one doesn't?

Emanuele (Ema)

@ematipico.xyz

26 May

Maybe they don't deem it a security issue, but just a bug

David Sherret

@dsherret.dev

26 May

I was wondering that, but one of the issues I reported was that https dependencies didn’t store a checksum in the lock file. It would be possible to serve a different package to someone running bun install from a data centre ip with a bun user agent for example (ex. on deployment)