I debated putting this editorializing in the title, but:

At $work we've been refreshing the Bun release page for days, wondering when they would push the fix. The PR with the change merged over 72 hours ago: https://github.com/oven-sh/bun/commit/ea6a2c7b7c98862627760d...

I'm not a security expert, but package managers seem uniquely vulnerable to MITM attacks.

I don't really see the point of spending $MM in tokens to create a software factory if you can't push security releases out in a timely fashion.