Bun Mascot Cries Over Being Called a Supply Chain Risk

Description

A screenshot of a tweet from the verified Bun account (@bunjavascript) posted 6 hours prior, reading 'am i a supply chain risk now???'. Below the text is a large illustration of Bun's kawaii steamed-bun mascot sobbing dramatically: huge glossy black anime eyes brimming with stylized blue tears, pink blush cheeks, a wobbling distressed mouth, and tear droplets falling from its face, all on a white circle against a black background. Tweet metrics show 116 replies, 357 reposts, 5K likes, and 179K views (counters rendered in Russian locale, 'тыс.'). The joke references the JavaScript ecosystem's recurring npm supply-chain-attack panics and the scrutiny runtimes and dependencies face after such incidents

Common Tags

SoftwareSupplyChainSecurity JavaScriptEcosystem NPMPackages DependencyManagement Javascript Security TechTwitter NPM

Comments

Anonymous ★ Top Pick Don't cry, Bun - you're not a supply chain risk until you're in package-lock.json of something that matters

Anonymous ★ Top Pick

Don't cry, Bun - you're not a supply chain risk until you're in package-lock.json of something that matters
Anonymous

Geopolitical risk is now a transitive dependency, and the lockfile has no override.
@drbogar 5mo

I missed it. Can someone fill me in on the context?
1. @deimossos 5mo
  
  anthropic decided not to colaborate with the pentagon to make ai kill robots, so the pentagon decided to make anthropic a supply chain risk (now contractors working with pentagon can't use anthropic products)
  
  @yuri_kilochek 5mo
  
  and what does bun have to do with it?
  
  @deimossos 5mo
  
  bun was acquired by anthropic recently
  
  @drbogar 5mo
  
  Thank you!
@paul_ssupp 5mo

Same…