
Security News
Attackers Are Hunting High-Impact Node.js Maintainers in a Coordinated Social Engineering Campaign
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.
@savvy-web/bun-builder
Advanced tools
Bun-based build system for Node.js libraries with automatic package.json transformation, TypeScript declaration bundling, and multi-target support
Build TypeScript libraries in milliseconds with Bun's native bundler. Automatic
entry detection from package.json, rolled-up .d.ts declarations, and
catalog:/workspace: resolution for monorepo publishing -- zero configuration
required.
.d.ts, or preserve source structure with raw declarationscatalog: and workspace: protocols for npm publishingpublishConfig.targets directorybun add -D @savvy-web/bun-builder
bun add -D @microsoft/api-extractor @typescript/native-preview typescript @types/bun
Create a bun.config.ts file in your project root:
import { BunLibraryBuilder } from '@savvy-web/bun-builder';
export default BunLibraryBuilder.create({});
Run the build:
bun run bun.config.ts # Build all targets
bun run bun.config.ts --env-mode dev # Dev build only
bun run bun.config.ts --env-mode npm # npm build only
The builder ships with sensible defaults -- most projects need no configuration:
| Option | Default | Description |
|---|---|---|
bundle | true | Bundled output with rolled-up .d.ts via API Extractor |
splitting | true (multi-entry) / false (single-entry) | Code splitting for shared modules between entry points |
apiModel | true | API model generation for the npm target |
tsdoc.warnings | "fail" (CI) / "log" (local) | TSDoc warning severity |
Set bundle: false to preserve the source directory structure in output.
Files are compiled individually instead of bundled, and raw .d.ts files are
emitted directly (no DTS rollup). API model generation still works if enabled.
Test files (.test.ts, .spec.ts) and __test__/__tests__ directories are
automatically excluded from declaration output via import graph analysis.
import { BunLibraryBuilder } from '@savvy-web/bun-builder';
export default BunLibraryBuilder.create({
bundle: false,
});
API Extractor TSDoc warnings are collected and reported with source file and
line information. Control the behavior with the tsdoc.warnings option:
import { BunLibraryBuilder } from '@savvy-web/bun-builder';
export default BunLibraryBuilder.create({
apiModel: {
tsdoc: {
warnings: 'fail', // 'fail' | 'log' | 'none'
},
},
});
"fail" -- Fail the build on TSDoc warnings (default in CI)"log" -- Log warnings but continue (default locally)"none" -- Suppress warnings entirelyFor fine-grained control, use suppressWarnings to silence specific messages:
export default BunLibraryBuilder.create({
apiModel: {
suppressWarnings: [
{ messageId: 'ae-forgotten-export', pattern: '_InternalHelper' },
{ pattern: '^Analysis will use' },
],
},
});
The package includes a base tsconfig optimized for ESM library builds:
{
"$schema": "https://json.schemastore.org/tsconfig",
"extends": "@savvy-web/bun-builder/tsconfig/ecma/lib.json"
}
For configuration options, API reference, and advanced usage:
See CONTRIBUTING.md for development setup and guidelines.
MIT
FAQs
Bun-based build system for Node.js libraries with automatic package.json transformation, TypeScript declaration bundling, and multi-target support
We found that @savvy-web/bun-builder demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.

Security News
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.

Security News
Node.js has paused its bug bounty program after funding ended, removing payouts for vulnerability reports but keeping its security process unchanged.