Mend SCA now supports Bun, with reachability built in

TL;DR: Mend SCA now scans Bun-managed JavaScript and TypeScript projects, including both the text-based bun.lock and legacy binary bun.lockb lockfiles. It detects direct and transitive dependencies automatically, works in the Mend CLI and every repository integration, and supports reachability analysis so teams can fix the vulnerabilities their code actually calls first.

Key takeaways

• Bun is a fast, Node.js-compatible JavaScript runtime and package manager used by roughly one in five JavaScript developers.
• AI coding agents increasingly choose Bun, and they commit full bun.lock files that often go unreviewed.
• Mend SCA scans Bun projects with no configuration: any folder with a package.json and a Bun lockfile is detected automatically.
• Reachability analysis marks each Bun dependency vulnerability as reachable or unreachable, for both JavaScript and TypeScript.

Why does Bun security matter now?

Bun has moved from niche to mainstream, and AI-assisted development is accelerating that shift. Developers choose it for speed, AI coding agents reach for it when starting new projects, and Claude Code ships as a Bun executable to millions of machines. The bun.lock that lands in a repo is often generated by an agent and committed without a second look, which means it can carry a long tail of transitive packages and known vulnerabilities that nobody has reviewed.

What is Bun?

Bun is a fast, Node.js-compatible JavaScript runtime that bundles its own package manager, test runner, and bundler into a single tool. It runs TypeScript directly with no build step, claims installs up to 30x faster than npm, and works as a drop-in replacement for npm, Yarn, and pnpm.

One detail matters for dependency scanning: bun install writes its own lockfile. That is either the legacy binary bun.lockb or the text-based bun.lock, which became the default in Bun 1.2.

How fast is Bun adoption growing?

Roughly one in five JavaScript developers uses Bun, and 2026 numbers show the curve still climbing. According to a May 2026 comparison citing GitHub and npm registry data:

• The Bun repository passed 91,800 GitHub stars by mid-May 2026.
• The bun npm package pulled about 1.5 million downloads a week (5.9 million over the trailing 30 days).
• Weekly downloads roughly tripled year over year.

Why are AI coding agents choosing Bun?

AI coding agents are pushing Bun adoption from both directions.

Demand side: Bun gives an agent a single tool, zero-configuration TypeScript, and fast installs, so there is less to get wrong when starting a project.

Supply side: Claude Code, Anthropic’s coding agent, ships as a Bun executable to millions of developers. When Claude Code reached a $1 billion revenue run rate six months after launch, Anthropic acquired Bun outright, as Anthropic announced in December 2025. Bun stays MIT-licensed and built in public, but it now has a parent with a direct commercial interest in keeping it fast, stable, and everywhere.

For security teams, the result is a dependency tree nobody has reviewed. An agent generating a service also generates its dependencies, runs the install, and commits the full bun.lock with the code, all in seconds. More code is being written per engineer than ever, more of it lives in Bun projects, and less of its dependency surface has been read by a person. That is the gap a software composition analysis (SCA) scanner has to close.

How does Mend SCA support Bun?

Mend SCA scans Bun-managed JavaScript and TypeScript projects everywhere it scans npm projects: the Mend CLI and every repository integration (Classic, Developer Platform, and Self-Hosted). Direct and transitive dependencies are detected automatically for any project with a package.json and a bun.lock or bun.lockb file, and reachability analysis is fully supported.

Which Bun lockfiles does Mend SCA support?

Bun has two lockfile formats, and Mend SCA handles both.

Does scanning Bun projects require configuration?

No. Any folder with a package.json next to a Bun lockfile is scanned as a Bun project automatically. In addition:

• Repository scans never execute install scripts.
• Bun workspaces and private registries are supported out of the box.
• devDependency handling and scan settings work the same way they do for npm, Yarn, and pnpm projects.

The Mend SCA support matrix has the full configuration reference.

How does reachability analysis work for Bun projects?

Mend SCA reachability tells you whether a vulnerable function in a dependency is actually called by your code. It analyzes the project’s imports, builds a graph of how application code connects to the classes and files inside each dependency, and marks every vulnerability as reachable or unreachable.

The result is a findings list you can prioritize by real exposure rather than by severity score alone, so teams fix what attackers could actually reach first. Reachability works for Bun projects in both the Mend CLI and the repository integrations, just as it does for npm, Yarn, and pnpm, and it analyzes both JavaScript and TypeScript sources.

Frequently asked questions

Secure the Bun projects your team and your agents create

Bun is now in CI pipelines, production services, and the AI agents writing a growing share of new code. With Bun support in Mend SCA, the dependency trees it produces are covered: full dependency resolution for bun.lock and bun.lockb, reachability analysis to separate the vulnerabilities that matter from the ones that do not, and the same experience across the Mend CLI and every repository integration.

Whether your team chose Bun deliberately or an agent chose it for you, your Bun projects can be scanned today. See the Mend SCA documentation for the full configuration reference, or book a demo to see Bun scanning and reachability in action.