> ## Documentation Index
> Fetch the complete documentation index at: https://mintlify.com/oven-sh/bun/llms.txt
> Use this file to discover all available pages before exploring further.

# Lifecycle Scripts

> How Bun handles package lifecycle scripts securely, with explicit trust required for dependency scripts.

Packages on npm can define *lifecycle scripts* in their `package.json` — shell commands the package manager runs at specific points during installation or removal.

Common lifecycle scripts:

| Script           | When it runs                      |
| ---------------- | --------------------------------- |
| `preinstall`     | Before the package is installed   |
| `install`        | During installation               |
| `postinstall`    | After the package is installed    |
| `preuninstall`   | Before the package is uninstalled |
| `prepublishOnly` | Before the package is published   |
| `prepare`        | After install and before publish  |

## Bun's security model

Unlike npm, yarn, and pnpm, **Bun does not run lifecycle scripts for installed dependencies by default.** Arbitrary scripts executed silently during installation represent a supply chain attack vector.

Instead, Bun uses a "default-secure" approach: scripts only run for packages you have explicitly trusted.

## Your own project's scripts

Lifecycle scripts defined in your own `package.json` (the root package) always run. Only scripts belonging to *installed dependencies* are blocked by default.

```json theme={null}
{
  "name": "my-app",
  "scripts": {
    "postinstall": "node scripts/setup.js"
  }
}
```

## Trusting a dependency's lifecycle scripts

Add the package name to `trustedDependencies` in your root `package.json`, then reinstall:

```json theme={null}
{
  "name": "my-app",
  "trustedDependencies": ["node-sass", "esbuild"]
}
```

```bash theme={null}
bun install
```

Bun will now run `postinstall` (and other lifecycle scripts) for `node-sass` and `esbuild`.

## Default trusted packages

The top 500 npm packages that commonly require lifecycle scripts (such as `esbuild`, `sharp`, `node-sass`, `@swc/core`) are trusted automatically. You can view the full list on GitHub.

<Note>
  The default trusted list applies only to packages installed from npm. Packages from `file:`, `link:`, `git:`, or `github:` sources must be explicitly added to `trustedDependencies`, even if the package name appears on the default list.
</Note>

## Viewing blocked scripts

To see which installed packages had their lifecycle scripts blocked:

```bash theme={null}
bun pm untrusted
```

```
./node_modules/@biomejs/biome @1.8.3
 » [postinstall]: node scripts/postinstall.js

These dependencies had their lifecycle scripts blocked during install.
```

## Trusting packages interactively

To run blocked scripts and add the package to `trustedDependencies` in one step:

```bash theme={null}
bun pm trust @biomejs/biome
bun pm trust --all   # trust all currently untrusted packages
```

## Disabling all lifecycle scripts

To skip lifecycle scripts for every package, including trusted ones:

```bash theme={null}
bun install --ignore-scripts
```

## Concurrent scripts

Lifecycle scripts run in parallel during installation. The default concurrency is two times the reported CPU count (or `GOMAXPROCS`). To adjust:

```bash theme={null}
bun install --concurrent-scripts 5
```

Or configure in `bunfig.toml`:

```toml theme={null}
[install]
concurrentScripts = 8
```