Researcher says Bun's trusted install check can be bypassed through .bin links

X3r0Day says a rejected bin-linking report still yields install-time code execution on Bun 1.4.4 through a trusted package's postinstall script.

RuntimeWire · 2026-11-06T18:12:55.034Z