Plugin dependency installer now refuses to run bun if a bunfig.toml file is found
When Claude Code installs a plugin's dependencies, it used to just run bun install. Now, before doing that, it checks whether a bunfig.toml configuration file sits next to the lockfile. If it finds one, it skips the install entirely and shows an explicit security message instead of running bun.
A bunfig.toml file can load and run code during installation through bun's install.security scanner feature. Since a plugin's dependency folder could contain a bunfig.toml crafted by someone else, running bun automatically could execute unexpected code. Skipping the install in that case avoids running code you didn't ask for.
The entry above is what we published on the day. These lines were added later, as Anthropic's own pages caught up, and they sit beside the original rather than replacing it.
* If a `bunfig.toml` sits beside the bun lockfile, remove the `bunfig.toml`, or replace the bun lockfile with an npm lockfile.plugins-reference see the edit
Anthropic's documentation has since written up bunfig.toml, on Plugins reference.