Skip to content
AQ Score
FREE · RUNS IN YOUR BROWSER

Bun & Deno Install Script Checker for package-lock.json

Moving a Node project to Bun or Deno? Paste your package-lock.json to list every direct and transitive package whose preinstall, install or postinstall script will not run by default, then copy the Bun trustedDependencies list and the Deno --allow-scripts flag. The lockfile is analyzed on this page and never uploaded.

No uploadlockfileVersion 2 · 3Bun default list snapshot as of 2026-10-21

Check a package-lock.json

lockfileVersion 2 or 3 (npm 7 and newer). Analyzed in your browser; nothing is uploaded or stored.

HOW IT WORKS

How the checker decides

  1. 1. Reads the packages section. npm 7 and newer write a packages map to package-lock.json, and npm sets hasInstallScript: true on every installed package that has a preinstall, install or postinstall script. The root project, link entries and workspace folders are skipped.
  2. 2. Names each package. The name comes from the entry's name field (set for aliased installs) or from the path after the last node_modules/. Copies at the top level that your package.json (or a workspace) declares are marked direct; everything else is transitive.
  3. 3. Applies Bun's rule. Bun runs dependency lifecycle scripts only for packages on its default trusted list (when installed from npm) or listed in trustedDependencies. This page uses a snapshot of that list taken 2026-10-21.
  4. 4. Applies Deno's rule. Deno runs no npm lifecycle scripts unless you allow them, so every package with a script is listed for --allow-scripts.

Comparing runtimes more broadly? Read our Node.js vs Deno vs Bun comparison.

BEFORE YOU PASTE THE BUN SNIPPET

trustedDependencies replaces Bun's default list

Bun's lifecycle scripts documentation says that once package.json defines trustedDependencies, only the listed packages run scripts and the default list is ignored. If the snippet named only the packages Bun skips, packages such as esbuild or sharp would stop running their scripts. The generated snippet therefore lists every package with an install script in your lockfile, and the result shows which of them Bun already trusts by default. When Bun already trusts all of them, no snippet is shown.

After bun install, bun pm untrusted lists any scripts that were still blocked. In Deno, deno approve-scripts lets you review and approve pending scripts interactively.

LIMITS

What this tool does not do

  • • It does not read or run the scripts. A lockfile only records that a script exists. Skipped scripts often build a native addon (node-gyp or prebuilt binaries) or download a binary in postinstall; whether a package still works without its script depends on the package.
  • • It does not test Bun or Deno compatibility. Review each script before trusting it, then install and run your tests under the new runtime.
  • • It reads npm lockfiles only. lockfileVersion 1 (npm 5 and 6), yarn.lock, pnpm-lock.yaml and bun.lock are not supported.
  • • Its Bun list is a snapshot. Bun's default trusted list can change between releases; run bun pm default-trusted to print the list for your installed version.
FAQ

Frequently asked questions

Why doesn't Bun run my dependencies' postinstall scripts?

Bun does not run dependency lifecycle scripts by default. It runs them only for packages on its built-in default trusted list (for packages installed from npm) or for packages named in the trustedDependencies field of package.json. A package that is not installed from the npm registry (a git, tarball, file: or link: dependency) must also be declared directly in the package.json of your project or a workspace; otherwise Bun does not run its scripts even if it is listed, and bun pm untrusted marks it as cannot be trusted by name. After an install, bun pm untrusted lists the scripts Bun blocked.

Does adding trustedDependencies replace Bun's default trusted list?

Yes. Bun's documentation says that defining trustedDependencies replaces the default list rather than extending it, so packages such as esbuild or sharp stop running their scripts unless you list them too. That is why the snippet on this page also includes the default-trusted packages found in your lockfile, and why no snippet is shown when Bun already trusts every package that has a script.

How do I allow npm lifecycle scripts in Deno?

Deno does not run npm lifecycle scripts by default. Pass --allow-scripts=npm:<name> to deno install (separate several packages with commas), list them in the allowScripts field of deno.json, or review them interactively with deno approve-scripts. Scripts only run when packages are installed into a local node_modules directory; projects with a package.json get one automatically.

Why does the checker say my lockfile is version 1?

Lockfiles written by npm 5 and 6 (lockfileVersion 1) do not have the hasInstallScript flag this page reads. With npm 7 or newer, run npm install --package-lock-only to rewrite package-lock.json (npm documents that this option ignores node_modules), then paste the new file.

Is my package-lock.json uploaded?

No. The file is read and analyzed by JavaScript on this page. Its contents are not sent to AQ Score, analytics or ad services, and nothing is stored.

Sources (checked 2026-10-21)