coreybutler · Oct 21, 2026 · Oct 20, 2026 · Oct 21, 2026
diff --git a/docs/cfg/core.md b/docs/cfg/core.md
@@ -88,13 +88,20 @@ nvm config set auto_detect=.nvmrc,.node-version
 | Option | Default | Values | Description |
 |--------|---------|--------|-------------|
 | `pm_mismatch_action` | `error` | `ignore`, `warn`, `error` | Action to take when a mismatch between npm/pnpm/yarn and Node.js versions is detected during install or use:<br/><br/><ul><li>ignore: stay silent</li><li>warn: continue after a warning</li><li> error: stop the operation (safest default)</li></ul>|
+| `shim_bun` | Community: `false`<br/>Certified Builds: `true` | Boolean | Wrap `bun` and `bunx` so OpenSSF malware checks run when bun is used as a package manager. NVM for Windows does not install bun and does not switch bun versions. Set `false` to remove the shims. HKLM `ShimBun` wins over HKCU. See [Package Manager Shims](../command/package-manager-shims#bun-malware-wrap). |
+
+```powershell
+nvm config set shim_bun=false
+```
 
 ## Logging and announcements
 
 | Option | Default | Values | Description |
 |--------|---------|--------|-------------|
 | `log_executions` | `false` | Boolean | Whether to log every Node.js invocation (ex: `node file.js`). (shim-only) |
-| `disable_announcements` | `false` | Boolean | Whether to disable project and release announcements. On Certified Builds, license expiry warnings still run when a commercial license is present. |
+| `disable_announcements` | `false` | Boolean | Whether to disable project and release announcements. On Certified Builds, license expiry warnings still run when a commercial license is present. This does not suppress malware definition or malware block notifications. |
+| `skip_malware_checks` | `false` | Boolean | Skip malware checks for package-manager and node shims. The definition file still updates. HKLM `SkipMalwareChecks` wins over HKCU. |
+| `notify_malware_definitions` | `true` | Boolean | Certified only. Show a silent notification after malware definitions change. HKLM can force it off. |
 
 ```powershell
 nvm config set log_executions=true

diff --git a/docs/cfg/enterprise/registry.md b/docs/cfg/enterprise/registry.md
@@ -52,9 +52,15 @@ See [Administrative Templates](ad) for GPO and Intune deployment. Download ADMX/
 |**Local install source**|`LocalInstallDir`|**Overridable** (`local_dir`). Alternate local directory for Node.js archives (air-gapped mirrors). Overrides cache.<br /><br />`REG_SZ`|
 |**Local install only**|`LocalInstallOnly`|**Overridable** (`local_install_only`). Restrict installs to `LocalInstallDir` only.<br /><br />- `0` = off<br />- `1` = on<br /><br />Default: `0`<br /><br />`REG_DWORD`|
 |**Audit logging**|`LogExecutions`|**Overridable** (`log_executions`). Log every Node.js invocation to the Windows Event Log (shim-only). Most useful on **Audit+** (structured ETW).<br /><br />- `0` = off<br />- `1` = on<br /><br />Default: `0`<br /><br />`REG_DWORD`|
+|**Skip malware checks**|`SkipMalwareChecks`|**Overridable** (`skip_malware_checks`). Skip malware checks for package-manager and node shims. The definition file still updates. HKLM wins over HKCU.<br /><br />- `0` = check<br />- `1` = skip<br /><br />Default: `0`<br /><br />`REG_DWORD`|
+|**Wrap bun for malware checks**|`ShimBun`|**Overridable** (`shim_bun`). Wrap `bun` and `bunx` so OpenSSF malware checks run when bun is used as a package manager. NVM for Windows does not install bun and does not switch bun versions. HKLM wins over HKCU.<br /><br />- `0` = no bun shims<br />- `1` = create `{DataRoot}/.shim/bun.exe` and `bunx.exe`<br /><br />Default: `0` Community, `1` Certified Builds<br /><br />`REG_DWORD`|
+|**Notify malware definitions**|`NotifyMalwareDefinitions`|**Overridable** (`notify_malware_definitions`). Certified only. Silent toast after definitions change. HKLM can force it off.<br /><br />- `0` = hide<br />- `1` = show<br /><br />Default: `1`<br /><br />`REG_DWORD`|
+|**Malware allow list**|`MalwareAllowList`|HKLM only. Patterns that clear an OpenSSF hit. Byte-for-byte. A `*` clears every OpenSSF hit. Does not clear an organization block. Empty allows nothing.<br /><br />`REG_MULTI_SZ`|
+|**Malware block list**|`MalwareBlockList`|Certified only. HKLM patterns that always block, or one `https://` policy URL. Community builds ignore this list.<br /><br />`REG_MULTI_SZ`|
+|**Malware trust conflict**|`MalwareTrustConflict`|Certified only. **Overridable** (`malware_trust_conflict`). `prevent` (default) blocks a trusted or approved OpenSSF hit. `continue` lets that explicit trust or approval through. HKLM wins over HKCU.<br /><br />`REG_SZ`|
 |**Node.js download mirrors**|`MirrorNode`|**Overridable** (`node_mirror`). Ordered mirror list; first successful response wins. See [Download Mirrors](../features/mirrors). Author `*.author.io` mirrors need Governance licensing — see [Version Firewall + Author Mirror](../features/author-mirror).<br /><br />Default: `https://nodejs.org/dist`<br /><br />`REG_MULTI_SZ`|
 |**npm registry mirrors**|`MirrorNpm`|**Overridable** (`npm_mirror`). Ordered npm registry list. Used as shim registry fallback.<br /><br />Default: `https://registry.npmjs.org`<br /><br />`REG_MULTI_SZ`|
-|**Operating mode**|`OperatingMode`|**Overridable** (`mode`). How NVM for Windows manages Node.js versions.<br /><br />**Shim** (recommended) uses signed shims to intercept `node`, `npm`, `npx`, `yarn`, and `pnpm`. Required for runtime policies (audit logging, auto-detect, ACL).<br /><br />**Link** uses NTFS junctions/symlinks on PATH.<br /><br />Default: `shim`<br /><br />`REG_SZ`|
+|**Operating mode**|`OperatingMode`|**Overridable** (`mode`). How NVM for Windows manages Node.js versions.<br /><br />**Shim** (recommended) uses signed shims to intercept `node`, `npm`, `npx`, `yarn`, `pnpm`, and (when `ShimBun` is on) `bun` / `bunx`. Required for runtime policies (audit logging, auto-detect, ACL).<br /><br />**Link** uses NTFS junctions/symlinks on PATH.<br /><br />Default: `shim`<br /><br />`REG_SZ`|
 |**Package manager mismatch action**|`PackageManagerMismatchAction`|**Overridable** (`pm_mismatch_action`). Behavior when npm/pnpm/yarn version mismatches Node during install or use (shim-only).<br /><br />- `ignore`<br />- `warn`<br />- `error`<br /><br />Default: `error`<br /><br />`REG_SZ`|
 |**Proxy URL**|`Proxy`|**Overridable** (`proxy`). Proxy for downloads. Basic and Bearer work on all certified editions. See [Download Mirrors](../features/mirrors#http-proxies).<br /><br />`REG_SZ`|
 |**Proxy auth value**|`ProxyAuth`|**Overridable** (`proxy_auth`). Credentials or bearer token (stored in plain text).<br /><br />- `user:pass`<br />- `Bearer YOUR_TOKEN`<br /><br />`REG_SZ`|
@@ -126,6 +132,10 @@ Windows Registry Editor Version 5.00
 "FirewallSkipLockfile"=dword:00000000
 "DisableUpgrade"=dword:00000001
 "DisableAnnouncements"=dword:00000001
+"SkipMalwareChecks"=dword:00000000
+"ShimBun"=dword:00000001
+"NotifyMalwareDefinitions"=dword:00000001
+"MalwareTrustConflict"="prevent"
 
 ; --- Shim runtime (requires OperatingMode=shim) ---
 "DefaultDetectFile"=".nvmrc"

diff --git a/docs/command/global-module-shims.md b/docs/command/global-module-shims.md
@@ -9,7 +9,7 @@ slug: /command/global-module-shims
 
 In **shim** mode, globally installed CLI tools (anything that ships a `.cmd` next to the active Node install — for example `tsc`, `eslint`, `prettier`) are not invoked from that folder directly. NVM for Windows places a hardlink (or copy) of **`proxy.exe`** on `PATH` as `{DataRoot}/.shim/{name}.exe`.
 
-Package managers (`npm`, `npx`, `yarn`, `pnpm`, `corepack`) use the same `proxy.exe` binary; see [Package Manager Shims](/command/package-manager-shims). The [node shim](/command/node) is a separate binary.
+Package managers (`npm`, `npx`, `yarn`, `pnpm`, `corepack`, and bun when `shim_bun` is on) use the same `proxy.exe` binary; see [Package Manager Shims](/command/package-manager-shims). The [node shim](/command/node) is a separate binary.
 
 ## How a global command is shimmed
 

diff --git a/docs/command/index.md b/docs/command/index.md
@@ -12,7 +12,7 @@ Command documentation for NVM for Windows v2:
 |---------|----------|
 | [nvm](/command/nvm/) | `nvm.exe` CLI — install, use, list, config, cache, and related commands |
 | [node (shim)](/command/node) | Runtime `node` shim flags (`--nvm-use`, `--nvm-which`, …) |
-| [Package Manager Shims](/command/package-manager-shims) | `proxy.exe` for npm/npx/yarn/pnpm |
+| [Package Manager Shims](/command/package-manager-shims) | `proxy.exe` for npm/npx/yarn/pnpm and optional bun |
 | [Global Module Shims](/command/global-module-shims) | `proxy.exe` hardlinks for global CLIs (`tsc`, …) |
 
 Start with [`nvm install`](/command/nvm/install/) and [`nvm use`](/command/nvm/use/), or [Operating Modes](/features/modes) for shim vs link.
diff --git a/docs/command/node.md b/docs/command/node.md
@@ -66,7 +66,7 @@ The shim adds roughly 1–3 ms of resolution work. Windows still pays `CreatePro
 
 ## Related
 
-- [Package Manager Shims](/command/package-manager-shims) — `proxy.exe` for npm/npx/yarn/pnpm
+- [Package Manager Shims](/command/package-manager-shims) — `proxy.exe` for npm/npx/yarn/pnpm and optional bun
 - [Global Module Shims](/command/global-module-shims) — `proxy.exe` hardlinks for global CLIs
 - [`nvm use shim`](/command/nvm/use/shim)
 - [Error Codes](/troubleshooting/error-codes) — NVM4301 and related security codes
diff --git a/docs/command/nvm/cache/list.md b/docs/command/nvm/cache/list.md
@@ -19,7 +19,7 @@ nvm cache list [name ...] [flags]
 
 | Argument | Required | Description |
 |----------|----------|-------------|
-| `[name ...]` | No | Filter by cache name (for example `versions`, `metadata`). |
+| `[name ...]` | No | Filter by cache name (for example `versions`, `metadata`, `malware`). `malware` lists one row per lockfile stamp plus `malware.db`. |
 
 ## Flags
 

diff --git a/docs/command/nvm/cache/remove/all.md b/docs/command/nvm/cache/remove/all.md
@@ -5,7 +5,7 @@ sidebar_position: 3
 
 # nvm cache remove all
 
-Clear both metadata and versions caches.
+Clear metadata, versions, malware scan stamps, and `malware.db`.
 
 ## Usage
 

diff --git a/docs/command/nvm/cache/remove/index.md b/docs/command/nvm/cache/remove/index.md
@@ -15,7 +15,8 @@ Remove cached artifacts.
 |------------|-------------|
 | [`version`](./version) | Remove cached Node.js archives (default). |
 | [`metadata`](./metadata) | Remove cached metadata files. |
-| [`all`](./all) | Clear metadata and versions caches. |
+| [`all`](./all) | Clear metadata, versions, malware stamps, and `malware.db`. |
+| [`malware`](./malware) | Remove malware scan stamps, or `malware.db` when you pass that path. |
 
 ## Notes
 

diff --git a/docs/command/nvm/cache/remove/malware.md b/docs/command/nvm/cache/remove/malware.md
@@ -0,0 +1,24 @@
+---
+title: malware
+sidebar_position: 4
+---
+
+# nvm cache remove malware
+
+Remove malware scan stamps. With no path, every stamp is removed and `malware.db` stays. A path removes that stamp. `--prompt` can also select `malware.db`.
+
+`nvm cache remove all` removes the stamps and `malware.db`.
+
+## Usage
+
+```powershell
+nvm cache remove malware [path ...] [flags]
+```
+
+## Flags
+
+| Flag | Short | Description |
+|------|-------|-------------|
+| `--prompt` | `-p` | Pick stamps, `malware.db`, or both. |
+
+Removal honors [`allow_download_cache_removal`](../../../../cfg/core#downloads-and-mirrors).
diff --git a/docs/command/package-manager-shims.md b/docs/command/package-manager-shims.md
@@ -7,18 +7,18 @@ slug: /command/package-manager-shims
 
 # Package Manager Shims
 
-In **shim** mode, package managers are not run from the active Node.js folder directly. NVM for Windows places hardlinks (or copies) of a single Zig binary — **`proxy.exe`** — on `PATH` under names such as `npm.exe`, `npx.exe`, `yarn.exe`, and `pnpm.exe`.
+In **shim** mode, package managers are not run from the active Node.js folder directly. NVM for Windows places hardlinks (or copies) of a single Zig binary — **`proxy.exe`** — on `PATH` under names such as `npm.exe`, `npx.exe`, `yarn.exe`, `pnpm.exe`, and (when enabled) `bun.exe` / `bunx.exe`.
 
-The proxy resolves the active Node.js version (same rules as the [node shim](/command/node)), verifies trust, then delegates to the matching tool under that install.
+For npm, npx, yarn, pnpm, and corepack, the proxy resolves the active Node.js version (same rules as the [node shim](/command/node)), verifies trust, then delegates to the matching tool under that install. For bun, the proxy finds the bun you already installed and does not resolve Node.js.
 
 Global CLIs installed with those managers (for example `tsc`) use the same `proxy.exe` mechanism — see [Global Module Shims](/command/global-module-shims).
 
 ## How `proxy.exe` works
 
-1. Read the invoked basename (`npm`, `yarn`, …) from `argv[0]`.
+1. Read the invoked basename (`npm`, `yarn`, `bun`, …) from `argv[0]`.
 2. Parse and strip shim flags (`--nvm-use`, `--nvm-which`, `--nvm-shim-version`).
 3. Verify self-integrity when launched from `{DataRoot}/.shim/*.exe` (byte-compare to canonical `{DataRoot}/proxy.exe`).
-4. Resolve Node.js (preference / detection / `--nvm-use`) and optionally auto-install.
+4. For `bun` / `bunx`, find the installed bun binary, run malware checks on package-manager commands, spawn bun, and stop. For other names, resolve Node.js (preference / detection / `--nvm-use`) and optionally auto-install.
 5. Check the version directory is safe (not a reparse point, not cross-user writable) — failure → **NVM4305**.
 6. Locate the delegated command under the Node install (`.exe`, then `.cmd`, then `.bat`).
 7. Enforce package-manager constraints when policy applies (npm / npx / pnpm / yarn).
@@ -40,6 +40,7 @@ First-class names the proxy treats as constrained package managers:
 | `pnpm` | `pnpm.cmd` / `.exe` (also scanned from `PNPM_HOME\bin`) |
 | `yarn` | `yarn.cmd` / `.exe` |
 | `corepack` | `corepack` entry / `node_modules/corepack/dist/corepack.js` (when present) |
+| `bun` / `bunx` | Your existing bun install. See [Bun malware wrap](#bun-malware-wrap). |
 
 The same `--nvm-*` flags work on these commands:
 
@@ -53,6 +54,27 @@ When `auto_install` is enabled, missing auto-detected Node versions prompt/insta
 
 After global-affecting operations (for example `npm install -g`, yarn global/dlx/plugins, corepack enable/use), the proxy may trigger **reshim** so new [global CLI shims](/command/global-module-shims) are created.
 
+## Bun malware wrap
+
+NVM for Windows does not install bun. It does not switch bun versions. When `shim_bun` is on, `reshim` puts `bun.exe` and `bunx.exe` on `PATH` as copies of `proxy.exe`. The proxy finds the bun you already installed, then applies the same OpenSSF malware checks used for npm, pnpm, and yarn.
+
+Find order:
+
+1. `%BUN_INSTALL%\bin\bun.exe` (or `bunx.exe`)
+2. `%USERPROFILE%\.bun\bin\bun.exe`
+3. `PATH`, skipping `{DataRoot}/.shim`
+
+Malware checks run for `bun install` / `i` / `add` / `x` / `create` / `update` and for every `bunx` invocation. `bun test`, `bun run`, and other bun commands pass through with no package scan.
+
+Turn the wrap off to remove the extra `CreateProcessW` hop:
+
+```powershell
+nvm config set shim_bun=false
+nvm reshim
+```
+
+Defaults: **off** in Community builds. **On** in Certified Builds. HKLM `ShimBun` wins over HKCU. See [`shim_bun`](/cfg/core#package-managers).
+
 ## Integrity verification
 
 Shims fail closed when trust checks fail.
@@ -94,6 +116,7 @@ Trust entries are written when versions are installed, activated, or reshimed (`
     npx.exe
     yarn.exe
     pnpm.exe
+    bun.exe / bunx.exe      # when shim_bun is on
     <global-cli>.exe        # see Global Module Shims
     node.exe                # separate node shim binary
   .verify/                  # verify-cache public key material

diff --git a/docs/features/cache.md b/docs/features/cache.md
@@ -31,6 +31,7 @@ Under the NVM data root (parent of the install root; default `%LOCALAPPDATA%\Aut
 |-------|------|----------|
 | Versions | `.cache/versions` | Node.js `.7z` archives (`node-v{version}-win-{x64\|arm64}.7z`) |
 | Metadata | `.cache/metadata` | Sync/release index metadata (not install archives) |
+| Malware scans | `.cache/malware-scan` | One stamp per scanned lockfile. `malware.db` itself lives in the data root, next to this `.cache` directory |
 | HTTP | `.cache/http` | Short-lived HTTP bodies (for example SHASUM fetches) |
 
 If [`local_dir`](../cfg/registry#available-registry-keys) is set (see [registry policy](../cfg/registry)), that directory **replaces** `.cache/versions` as the archive source for installs.
@@ -54,6 +55,9 @@ nvm cache                  # list (alias: nvm cache list/ls)
 nvm cache add 24 lts       # prefetch archives
 nvm cache remove version 24.1.0
 nvm cache remove metadata
+nvm cache list malware
+nvm cache remove malware
+nvm cache remove malware --prompt
 nvm cache remove all
 nvm list cached            # versions view of cached archives
 ```

diff --git a/docs/features/log.md b/docs/features/log.md
@@ -19,3 +19,12 @@ If setup cannot elevate for `nvm --register-eventlog` (UAC canceled / non-admin)
 :::tip[Certified Builds — Advanced Logging]
 The **Advanced Logging** add-on (Certified Builds, available September 2026) writes structured entries with well-known SIEM event codes to a dedicated native NVM for Windows log (not the Application log). Use it for fleet SIEM integration and audit querying.
 :::
+
+## Malware feed
+
+These events are written only when advanced logging is on. They use Windows Event ID 120 on `NVM for Windows/Operational`. A block still prints in the terminal when that license is off, and that block does not write `package_manager.install`.
+
+| Code | Event | Payload |
+|------|--------|---------|
+| **NVM4601** | `malware.definitions_updated` | `added`, `removed`, `seq`, `previous_seq` |
+| **NVM4602** | `malware.package_blocked` | package name, version when known, command |
diff --git a/docs/features/notifications.md b/docs/features/notifications.md
@@ -52,3 +52,5 @@ Scheduled maintenance can also display notifications:
 | News feed | Feed entry title | Body is the entry description with links; skipped when [`disable_announcements`](../cfg/core#logging-and-announcements) is true |
 | Update available | Update Available | Version availability with View/Upgrade links; skipped when [`disable_announcements`](../cfg/core#logging-and-announcements) is true |
 | License expiry<br/>_(certified builds)_ | Expiration warning | Not suppressed by [`disable_announcements`](../cfg/core#logging-and-announcements); at most one notification per milestone/day. |
+| Malware definitions<br/>_(certified builds)_ | Malware definitions updated | Silent. Body is the added and removed counts. **Don't show again** sets `notify_malware_definitions` to false. Not suppressed by [`disable_announcements`](../cfg/core#logging-and-announcements). |
+| Malware block, console in the background | Malicious package blocked | Audible (`Notification.Reminder`). Names at most three packages, then `and N more`. Not suppressed by [`disable_announcements`](../cfg/core#logging-and-announcements). On a community build joined to Active Directory, Entra, or Google Workspace, the body adds: `Certified keeps a record of blocks like this for your security tools.` |
diff --git a/docs/guide/firewall.md b/docs/guide/firewall.md
@@ -16,6 +16,8 @@ Frontline controls for Node version installs, npm package installs, and self-upd
 | Version | Certified | `VersionAllowList` / `VersionBlockList` | Block `nvm install` of disallowed Node versions |
 | Module | Certified | `ApprovedModules` / `ApprovedGlobalModules` | Block npm/pnpm/yarn/npx install of disallowed packages (shim mode) |
 | Trust | Community + Certified | `TrustedModules`, `UntrustedModuleHandlerAction` | Auto-reshim or prompt when a global CLI self-updates |
+| Malware, surface | Community + Certified | `SkipMalwareChecks`, `MalwareAllowList`, `ShimBun` | Block an OpenSSF hit on the named package or on direct `package.json` dependencies. Default on. `ShimBun` wraps bun as a package manager only — NVM for Windows does not install bun and does not switch bun versions |
+| Malware, lockfile | Certified | `MalwareBlockList`, `MalwareTrustConflict` | Also scan the lockfile. An organization block list and trust conflict apply only here |
 
 ## Commands