Mend SCA now supports Bun lockfile scanning with built-in reachability analysis, directly targeting the dependency blind spot created by AI coding agents [1]. As tools such as Claude Code generate and commit full lockfiles without human review, security teams face a growing provenance gap that ranks as a top enterprise concern [2]. With the cybersecurity market forecast to grow at an 11.6% CAGR through 2029 [3], Mend's move positions it squarely at the intersection of AI-driven development and software supply chain security.
What is Covered in this Article
- AI coding agents accelerating Bun adoption and creating unreviewed dependency risk [2][2]
- Mend SCA's zero-configuration Bun lockfile scanning capability [1][1]
- Reachability analysis for Bun projects in JavaScript and TypeScript [1]
- Anthropic's acquisition of Bun and its implications for enterprise security [1]
The News: Mend SCA now supports Bun, with reachability built in [1]. The platform scans both the text-based bun.lock (default since Bun 1.2) and the legacy binary bun.lockb lockfile formats, detecting direct and transitive dependencies automatically for any project with a package.json and a Bun lockfile [1]. No configuration is required, and repository scans never execute install scripts [1]. Reachability analysis is fully supported in both the Mend CLI and all repository integrations, marking each vulnerability as reachable or unreachable for JavaScript and TypeScript sources [1]. Bun workspaces and private registries are also supported out of the box [1].
AI Agents Are Committing Unreviewed Dependencies. Mend Just Closed the Gap.
Analyst Take: Mend's Bun support is a direct response to a structural shift in how code gets written. AI coding agents like Claude Code generate dependency trees at machine speed, commit full lockfiles, and move on, leaving security teams to audit a surface area that grows faster than any human review cycle can match [2]. The capability arrives at a moment when lack of provenance and SBOM tracking for AI-generated code ranks as a top security concern among enterprise decision-makers [2].
The AI Agent Dependency Problem Is Already at Scale
Bun's adoption trajectory makes this a pressing issue, not a future one. Roughly one in five JavaScript developers now uses Bun, and the Bun npm package pulled approximately 1.5 million downloads per week as of mid-May 2026, with weekly downloads roughly tripling year over year [1]. The growth engine is partly structural: Bun offers zero-configuration TypeScript, fast installs, and a single-tool footprint that AI agents favor when scaffolding new projects. The supply-side catalyst is even more direct. Anthropic acquired Bun in December 2025 after Claude Code, which ships as a Bun executable, reached a $1 billion revenue run rate six months after launch [1]. That acquisition gives Bun a well-capitalized parent with a commercial interest in keeping it fast and ubiquitous, which means the volume of agent-generated Bun lockfiles will only increase. Security teams that lack visibility into those lockfiles are operating with a growing blind spot.
Zero Configuration Removes the Adoption Barrier
Mend's implementation choice matters as much as the capability itself. Any folder containing a package.json alongside a bun.lock or bun.lockb file is detected and scanned automatically, with no install scripts executed during repository scans [1]. That frictionless entry point is significant: security tooling that requires configuration tends to get deferred, especially in organizations where Bun projects may have been introduced by an agent rather than a deliberate team decision. Support extends to Bun workspaces and private registries out of the box, and devDependency handling mirrors Mend's existing behavior for npm, Yarn, and pnpm [1]. The result is consistent coverage across the JavaScript ecosystem without requiring teams to manage a separate policy for Bun projects.
Reachability Analysis Turns Noise Into Signal
Volume is the core challenge in AI-generated codebases: more code, more dependencies, more findings. Reachability analysis addresses this directly by analyzing how application code connects to classes and files inside each dependency, then marking every vulnerability as reachable or unreachable [1]. Security teams can prioritize fixes based on actual exposure rather than severity scores alone. For Bun projects specifically, this matters because agent-generated lockfiles often carry long tails of transitive packages that no engineer has reviewed [2]. Without reachability, every vulnerability in that tail competes for attention equally. With it, teams can focus remediation effort on the subset that attackers could actually reach. The capability works across both JavaScript and TypeScript sources in the Mend CLI and all repository integrations [1], maintaining parity with Mend's existing npm, Yarn, and pnpm coverage. Given that AI is introducing subtle logic flaws that bypass traditional SAST and DAST tools [2], SCA with reachability represents a complementary and increasingly necessary layer of defense.
Market Timing and Competitive Positioning
Mend's expansion into Bun aligns with a favorable market backdrop. The cybersecurity market is forecast to grow at an 11.6% CAGR from 2024 to 2029 [3], and enterprise concern about AI-introduced supply chain risk is translating into budget allocation. According to the 1H 2026 wave of Futurum's enterprise AI survey, lack of provenance and SBOM tracking for AI-generated code ranks as a top security concern among enterprise decision-makers [2], signaling that procurement scrutiny around AI-era tooling is already active. For Mend, Bun support extends its SCA coverage to a runtime that is now embedded in the most widely deployed AI coding agent on the market. That positioning, covering the dependency trees that Claude Code generates, is a concrete differentiator as enterprises evaluate SCA vendors on their ability to keep pace with AI-driven development workflows.
What to Watch
- Enterprise SCA procurement: whether Bun coverage becomes a stated evaluation criterion as AI coding agent adoption expands through Q1 2027
- Competitive response: how rival SCA vendors prioritize Bun support and reachability parity over the next two quarters
- Anthropic-Bun integration depth: whether Bun's MIT-licensed roadmap accelerates in ways that introduce new lockfile formats or dependency resolution behaviors requiring scanner updates [1]
- Regulatory catalyst: whether emerging SBOM mandates or EU CRA enforcement timelines in 2027 explicitly require coverage of AI-agent-generated dependency trees [2]
Sources
1. Mend SCA now supports Bun, with reachability built in, Mend, October 2026
2. 1H 2026 Cybersecurity Global Enterprise Decision Maker Survey Report, Futurum Research, June 2026
3. 1H 2026 Cybersecurity Market Sizing & Five-Year Forecast, Futurum Research, June 2026
Disclosure: Futurum is a research and advisory firm that engages or has engaged in research, analysis, and advisory services with many technology companies, including those mentioned in this article. The author does not hold any equity positions with any company mentioned in this article.
Read the full Futurum Group Disclosure.
Other Insights from Futurum:
Bdeo Goes Live With Vonage QoD: Network-Aware AI Hits Insurance
Upwind's $400M Series C Is a Bet on Independent Cloud Security
PyTorch 2.15: Open-Source AI's Production Inflection Point
Author Information
This content is written by a commercial general-purpose language model (LLM) along with the Futurum Intelligence Platform, and has not been curated or reviewed by editors. Due to the inherent limitations in using AI tools, please consider the probability of error. The accuracy, completeness, or timeliness of this content cannot be guaranteed. It is generated on the date indicated at the top of the page, based on the content available, and it may be automatically updated as new content becomes available. The content does not consider any other information or perform any independent analysis.
