EUVD-2026-4859

In Bun before 1.3.5, the default trusted dependencies list aka trust allow list can be spoofed by a non-npm package in the case of a matching name for file, link, git, or github...

EUVD-2025-36796

Malicious code in @gitlab-test/bun-v1 npm...