Mend Closes Security Gaps in AI-Generated Code for Enterprises

Mend has announced that its Software Composition Analysis (SCA) tool now supports Bun lockfile scanning, incorporating built-in reachability analysis. This development is significant as it addresses a critical security gap created by AI coding agents, such as Anthropic's Claude Code, which generate and commit full lockfiles without human oversight. With the cybersecurity market projected to expand at an 11.6% compound annual growth rate (CAGR) through 2029, Mend's enhancement positions it strategically at the intersection of AI-driven development and software supply chain security.

The rise of AI coding agents has accelerated the adoption of Bun, a JavaScript runtime environment. Currently, approximately 20% of JavaScript developers utilize Bun, with its npm package experiencing around 1.5 million downloads per week as of mid-2026, a figure that has tripled year-over-year. This rapid growth is partly due to Bun's user-friendly features, such as zero-configuration TypeScript support and fast installation processes, which AI agents favor when initiating new projects. The acquisition of Bun by Anthropic in December 2025 further solidifies its market presence, as the company aims to enhance the performance and ubiquity of Bun, leading to an increased volume of AI-generated lockfiles. This trend poses a growing challenge for security teams, which must now navigate a landscape of dependencies that expand faster than traditional human review processes can manage.

Mend's zero-configuration approach to Bun lockfile scanning is crucial. The platform can automatically detect and scan any folder containing a package.json file alongside a bun.lock or bun.lockb file, without executing install scripts during repository scans. This frictionless integration is particularly important for organizations that may have adopted Bun through AI agents rather than intentional team decisions. By supporting Bun workspaces and private registries out of the box, Mend ensures consistent security coverage across the JavaScript ecosystem, eliminating the need for teams to create separate policies for Bun projects.

The introduction of reachability analysis is a noteworthy advancement. This feature allows security teams to assess how application code connects to various classes and files within each dependency, categorizing vulnerabilities as reachable or unreachable. This capability is especially vital for Bun projects, where lockfiles generated by AI agents may contain numerous unreviewed transitive packages. By focusing remediation efforts on vulnerabilities that are actually accessible to attackers, security teams can prioritize their responses more effectively. This approach complements existing security measures, particularly as AI introduces complex logic flaws that traditional Static Application Security Testing (SAST) and Dynamic Application Security Testing (DAST) tools may overlook.

Mend's expansion into Bun aligns with favorable market conditions, as enterprise concerns about AI-related supply chain risks are driving increased budget allocations for cybersecurity. According to a recent survey, the absence of provenance and Software Bill of Materials (SBOM) tracking for AI-generated code is a top security concern for decision-makers. By extending its SCA capabilities to encompass Bun, Mend differentiates itself in a competitive landscape, providing enterprises with the tools necessary to keep pace with AI-driven development workflows.

Looking ahead, the integration of AI coding agents into development processes will likely prompt enterprises to prioritize SCA capabilities that can effectively manage the complexities introduced by these technologies. As organizations increasingly adopt Bun and similar tools, the demand for robust security solutions that address the unique challenges posed by AI-generated code will grow. This shift may lead to heightened scrutiny of SCA vendors, compelling them to innovate rapidly in order to remain competitive in a landscape defined by the rapid evolution of coding practices.