diff --git a/src/install/hosted_git_info.zig b/src/install/hosted_git_info.zig
index 67c35c11d6..9ff70822e8 100644
--- a/src/install/hosted_git_info.zig
+++ b/src/install/hosted_git_info.zig
@@ -518,7 +518,7 @@ pub fn isGitHubShorthand(npa_str: []const u8) bool {
     // Implements doesNotEndWithSlash
     const does_not_end_with_slash =
         if (pound_idx) |pi|
-            npa_str[pi - 1] != '/'
+            pi == 0 or npa_str[pi - 1] != '/'
         else
             npa_str.len >= 1 and npa_str[npa_str.len - 1] != '/';
 
diff --git a/test/cli/install/hosted-git-info/boundary-conditions.test.ts b/test/cli/install/hosted-git-info/boundary-conditions.test.ts
new file mode 100644
index 0000000000..d7d5511dcd
--- /dev/null
+++ b/test/cli/install/hosted-git-info/boundary-conditions.test.ts
@@ -0,0 +1,30 @@
+import { describe, expect, test } from "bun:test";
+import { bunEnv, bunExe, tempDir } from "harness";
+
+describe("hosted-git-info boundary conditions", () => {
+  test.each([{ description: "git with pound", dependency: "https://github.com/#" }])(
+    "handle $description",
+    async ({ description: _, dependency }) => {
+      using dir = tempDir("hosted-git-info-empty", {
+        "package.json": JSON.stringify({
+          name: "test",
+          dependencies: {
+            dependency,
+          },
+        }),
+      });
+
+      await using proc = Bun.spawn({
+        cmd: [bunExe(), "install"],
+        cwd: String(dir),
+        env: bunEnv,
+        stderr: "pipe",
+        stdout: "pipe",
+      });
+
+      const [stderr] = await Promise.all([proc.stderr.text(), proc.exited]);
+
+      expect(stderr).not.toContain("panic");
+    },
+  );
+});