
Research
/Security News
Shai Hulud Strikes Again (v2)
Another wave of Shai-Hulud campaign has hit npm with more than 500 packages and 700+ versions affected.


Sarah Gooding
July 22, 2025
Over the weekend, bun shipped a highly anticipated 1.2.19 release with significant improvements for developers working with monorepos.
This release introduces isolated installs with the new --linker=isolated option. This change is designed to improve dependency management in monorepos by preventing cross-package conflicts, an issue that has previously led developers to rely on other package managers.
The bun install --linker=isolated command restructures the node_modules layout to ensure each package remains self-contained. This approach addresses long-standing concerns about ghost dependencies and improves predictability for monorepo setups. This as a major step forward for Bun’s package manager.
This release positions Bun to compete more directly with pnpm, which has traditionally dominated monorepo workflows. Isolated installs make it easier for teams to migrate from other ecosystems without running into the dependency issues that previously made Bun harder to adopt for complex projects. For Bun, this is an important milestone in becoming a practical, full-featured replacement for Node.js and npm.
A new command, bun pm pkg, lets developers programmatically edit package.json by getting, setting, deleting, and even auto-fixing keys. This addition simplifies scripting around project configuration and mirrors the utility of npm pkg or pnpm pkg with Bun’s usual performance advantages.
Bun also improves workspace installs, fixing redundant evaluations that slowed down large monorepos. Dependency resolution logic is now consistent with other package managers, prioritizing devDependencies > optionalDependencies > dependencies > peerDependencies. The .npmrc settings link-workspace-packages and save-exact are now honored, bringing Bun closer to parity with npm and pnpm.
The new bun why command helps trace dependency chains, similar to yarn why, making it easier to understand why a package is installed.
Bun’s built-in PostgreSQL client, Bun.sql, now uses automatic query pipelining, yielding up to 5x performance gains for high-concurrency workloads compared to Node.js. A new --sql-preconnect flag reduces cold-start latency by pre-warming database connections at runtime, a welcome feature for serverless and low-latency applications.
Bun starts up 1ms faster and uses 3MB less memory thanks to low-level Zig optimizations. The bundler benefits from SIMD-accelerated comment parsing, removal of unused Symbol.for() calls, and smarter dead-code elimination in try...catch blocks, reducing bundle sizes.
The release also includes memory and startup optimizations, expanded Node.js API compatibility, and TypeScript type improvements. In total, the team resolved 163 issues, addressing more than 1,000 community-reported concerns.
This is a major update for Bun that has received positive overwhelmingly positive feedback, particularly from developers working with monorepos. The new linker resolves previous conflicts between dependencies and aligns Bun with workflows that have been difficult to support until now. Check out the full details in the 1.2.19 announcement post on the Bun website.
Subscribe to our newsletter
Get notified when we publish new security blog posts!
Try it now

Research
/Security News
Another wave of Shai-Hulud campaign has hit npm with more than 500 packages and 700+ versions affected.

Security News
ENISA has become a CVE Program Root, giving the EU a central authority for coordinating vulnerability reporting, disclosure, and cross-border response.

Research
/Security News
Malicious npm packages use Adspect cloaking and fake CAPTCHAs to fingerprint visitors and redirect victims to crypto-themed scam sites.