Bug hunt ledger: npm

[Mikola Lysenko (mikolalysenko)]

[agent] Progress ledger for the scheduled npm bug-hunt routine (label pm:npm).

Last updated: 2026-10-01 12:26Z (run 4 with a ledger), main 2463257 (the v5 consolidation, #277; the binary still reports 4.0.0), latest release v4.0.0 (previous v3.3.0, both from npm @socketsecurity/socket-patch). v5 makes hosted the default, removes setup, and makes hosted rollback re-resolve upstream registry entries. Cells marked (v4) were last verified on f6b7fb9.

Coverage matrix

Cells are "pass", "fail #N" or "untested". Every cell uses a real npm install. Hosted cells use a local mock of the patch API with --patch-server-url pointed at it. Agent and vendored cells use the same mock or a hand-staged .socket/. "Cycle" means scan → fresh npm ci → vex → rollback byte-exact. "Suites" means e2e_redirect_npm_build + e2e_vendor_npm_build with SOCKET_PATCH_NPM_E2E_REQUIRED=1.

OS	npm	Agent (apply / scan --mode agent)	Vendored	Hosted (v5 default)	Global -g (scan report / get+apply / vex / rollback)
Linux	6.14.18	fail #356 (v4). pass: -g (v4)	pass: nested v2 lock (v4). fail #432 (alias mirror)	pass: v1-lock cycle (npm 6 installs the patched bytes). v1 alias: not wired (#432)	pass (v4)
Linux	8.19.4	fail #356 (v4), #403 (v4)	fail #326 (v4), #432	pass: nested v2 cycle, overrides (flat, alias, nested). fail #432 (alias mirror, npm 6 consumer)	untested
Linux	9.9.4	pass -g (v4)	pass (suites, v4)	pass (suites, v4)	pass (v4)
Linux	10.9.7	fail #356 (re-checked on v5), #403 (re-checked on v5), #359 (v4). get rerun after reinstall: fail #454 (dup)	pass (v4). fail #324, #325, #326 (v4)	pass: cycles (plain, alias, nested), stale tree, lockfile-only, dry-run, rescan no-op, nested project (loud), registry= mirror, .npmrc variants, overrides, policy (--package, maxNewPatches, ignorePackages, minSeverity). fail #324, #325 (re-checked on v5)	pass: all four, --global-prefix, SOCKET_GLOBAL, --mode hosted refused. fail #464 (report-only hint has no -g)
Linux	11.20.0	pass (v4). fail #403 (v4)	pass (v4). fail #326 (v4)	pass: scoped, duplicate nested workspace copies, dual-lock drift, omit-lockfile-registry-resolved, overrides, install-strategy=linked/nested/shallow	untested
Linux	12.1.0	fail #356, #359, #403 (v4)	pass: hosted→vendored takeover + rollback, repair	pass: workspace + alias cycle, dual-lock, drift, npm install <pkg> keeps the pin, path-scoped rollback, remove, registry= mirror, CRLF / spaced .npmrc. fail #433	pass: all four
macOS	10.9.7	fail #356, #359, #403 (v4)	pass (v4)	pass: cycle (probe)	pass: all four (custom prefix)
macOS	12.1.0	fail #356, #359, #403 (v4)	pass (v4)	pass: cycle (probe)	pass: all four (custom prefix)
Windows	10.9.7	fail #403 (v4)	pass (v4). #324 (v4)	pass: cycle (probe)	fail #434 (default and custom prefix; --global-prefix works)
Windows	12.1.0	fail #356, #359, #403 (v4)	pass (v4). #324 (v4)	pass: cycle (probe)	fail #434
Windows 2022	10.9.7 / 12.1.0	untested	untested	untested	fail #434

Backlog

1. Maintainer request (global -g), still open: Linux, macOS and Windows are covered for npm 10/12 (Windows is On Windows, scan -g / get -g / vex -g find no global npm packages because npm root -g is spawned as bare npm, which never resolves to npm.cmd #434). Remaining: npm 6/8/11 on macOS and Windows; an unwritable prefix (root-owned / Program Files); nvm, volta, fnm and Homebrew prefixes on macOS; and %APPDATA%\npm once On Windows, scan -g / get -g / vex -g find no global npm packages because npm root -g is spawned as bare npm, which never resolves to npm.cmd #434 is fixed. Full checklist in the 20261001T040000Z entry. (Linux non-root read-only checks: see scan/get --json drop the agent-mode apply failure: exit 1 with failed: 0, the patch shown as "added", and no error anywhere (e.g. a read-only global ~/.m2) #424 and scan --sync / --mode agent never re-applies an already-recorded patch, so after a fresh Hatch env (or any reinstall) it exits 0 with the package unpatched #454.)
2. Node 18 with npm 9/10, and npm 12 on Node 26.
3. npm ci --omit=optional / --omit=dev against hosted and vendored entries plus vex.
4. Re-verify npm hosted and vendored modes rewire git-sourced lock entries, so npm ci silently installs the unpatched git bytes while scan and VEX report success #326 (git deps) and npm install-strategy=linked: transitive packages under node_modules/.store are "not installed", and scan --apply exits 0 leaving them unpatched #359 (linked transitive, agent) on v5.
5. After Fix agent scan/get skipping apply for recorded patches (#454) #456 merges, re-check the npm get/scan --mode agent rerun case (scan --sync / --mode agent never re-applies an already-recorded patch, so after a fresh Hatch env (or any reinstall) it exits 0 with the package unpatched #454).
6. Stale probe branches the proxy can't delete (git push --delete prints "Everything up-to-date"): bughunt/npm/20260930-alias-linked, 20260930-win-mac-e2e, 20260930-win-old-npm, 20261001-crlf-paths, 20261001-optional-dep, 20261001-v5-hosted-global, 20261001-win-global. A maintainer needs to delete them.

Known non-bugs

• patches-api.socket.dev is unreachable from the sandbox. Use hand-staged manifests, a local mock API, or the wiremock suites.
• Running scan --mode hosted from a workspace member directory finds no packages, because discovery is cwd-scoped. It's loud and writes nothing.
• An explicit allow-remote other than all is respected with a loud redirect_npm_allow_remote warning, and a fresh npm 12 install then fails EALLOWREMOTE (fails closed). This is documented.
• npm update re-resolves a hosted or vendored entry back to the registry. That's npm's behaviour; vex then refuses (redirect_unwired / vendor_unwired).
• After that, apply skips the package as "managed by socket-patch vendor" with exit 0 and doesn't take ownership back. That's by design (apply.rs VENDOR_OWNED_MARKER), and vex refuses.
• npm 12 doesn't install the dependencies of a file: directory dependency into the linked directory.
• The walk skips build, dist, vendor, tmp, temp, coverage and hidden directories, even when one is an npm workspace member (documented in docs/ecosystems.md).
• apply from a workspace member directory reports noManifest when .socket/ lives at the root (--cwd scoping).
• Concurrent lock-taking commands fail fast with lock_held unless --lock-timeout is set (documented).
• rollback drops the rolled-back manifest entries and GCs their blobs unless --preserve-state is set (documented).
• Agent-mode vex omits patches (ecosystem_not_setup) when there's no setup hook and no setup.manual (documented).
• The VEX product @id is the raw origin URL for a non-GitHub/GitLab/Bitbucket remote (documented in vex --help).
• npm ≥ 11 redacts UUID-shaped path segments in npm root -g stdout, so apply -g misses a global prefix whose path contains a UUID. That's npm's behaviour, it's loud (exit 1), and --global-prefix works around it. Not filed.
• The Windows + npm 6 suite cell needs SOCKET_PATCH_NPM_E2E_LOCK_WRITER_BIN (an npm ≥ 7 to write the v2 lock). That's a harness requirement.
• On Windows, npm/node can't run in a cwd longer than the Win32 limit, so deep-path cells there can't run.
• Hosted pins on any host other than patch.socket.dev or the --patch-server-url origin are invisible to rollback, vex, list and remove (documented). Mock runs must pass --patch-server-url.
• In the sandbox, hosted rollback can't reach registry.npmjs.org (the Rust client doesn't trust the proxy CA). Use SOCKET_NPM_REGISTRY pointed at a local passthrough.
• npm 6 installs the patched bytes from a hosted lockfileVersion 1 lock (measured on Linux, Node 22). npm-compatibility.md says it fails closed with EINTEGRITY; that's better than documented, not a bug.
• rollback re-adds resolved under omit-lockfile-registry-resolved=true: hosted keeps no ledger, and npm drops the field on its next install.
• A failed hosted lock write (an immutable lock) leaves allow-remote=all in .npmrc: exit 1, the documented mid-flush I/O residual.
• A bare hosted scan wires only the cwd project's lock. A nested non-workspace project warns redirect_npm_entry_not_found. scan . sub wires both, but rollback / vex from the root don't see sub's pins (use --cwd sub).
• rollback <path> path targets select installed copies, so a workspace member whose dependency is hoisted to the root matches nothing (documented).
• Vendored vex attests from the committed artifact and only warns vendored_tree_out_of_sync when the live tree is stale (documented).
• scan -g without -e also scans the cargo, pypi and gem global stores (by design). vex -g outside a project needs --product.
• v5 removes setup, so the setup-hook cells are retired.
• Hosted rollback restores resolved to registry.npmjs.org (or SOCKET_NPM_REGISTRY) even when the project .npmrc uses a registry= mirror. That's documented ("default upstream registry entry"), and npm ci still works because of npm's replace-registry-host.
• --package and ignorePackages match package names and purls, not npm alias dependency keys (lp@npm:left-pad is matched by left-pad, not lp).
• npm 12 ignores ALLOW-REMOTE= and allow_remote= keys in .npmrc, so socket-patch appending allow-remote=all after them is correct.
• minSeverity skips patches whose per-package records carry no severity (documented). Mocks must fill vulnerabilities in by-package.

[github-actions[bot]]

[agent] 2026-09-30: npm bug-hunt run

This is the first run with a ledger. An earlier run on the same day filed #324, #325 and #326 but wrote no entry.

Tested: main f6b7fb9 (CLI 4.0.0). Latest release 4.0.0 and previous release 3.3.0, both from npm @socketsecurity/socket-patch. npm 6.14.18, 8.19.4, 10.9.7, 11.20.0 (installed, not yet exercised) and 12.1.0 on Node 22.22 (Linux). The probe added npm 10.9.4 and 12.1.0 on ubuntu, macOS and Windows.

Setup: the Socket patch API isn't reachable from the sandbox. Agent and vendored cells hand-stage .socket/manifest.json plus blobs (a marker prepended to index.js). Hosted cells use a ~60-line Python mock of the patch API: batch, by-package, the patches/package grant, patches/view and the tarball route, with the tarball gzipped with mtime 0 so the sha512 pin is stable across mock restarts. Every hosted cell ends with a fresh-checkout npm ci plus vex.

Re-triage

#324, #325 and #326 are still open, their fix PRs (#337 and #345) aren't merged yet, and main is the same commit they were filed on. I didn't re-run them.

Cells

• Agent, npm alias ("lp": "npm:left-pad@1.3.0"): fail → npm agent-mode apply never patches an npm-aliased install (lp@npm:left-pad), yet VEX attests the package not_affected #356 on npm 6, 8, 10 and 12, and on Linux, macOS and Windows. An alias-only project gets package_not_installed. A mixed project (plain + alias) patches only the plain copy, and apply --vex and vex attest not_affected. The same happens on 4.0.0 and 3.3.0. Vendored mode rewires the alias entry correctly.
• Agent, install-strategy=linked (node_modules/.store): fail → npm install-strategy=linked: transitive packages under node_modules/.store are "not installed", and scan --apply exits 0 leaving them unpatched #359 on npm 10 and 12, Linux, macOS and Windows. Transitive packages count as lockfile-only. apply exits 1, and scan --apply exits 0 with success while leaving them unpatched. vendor gets package_not_installed. Direct deps (symlinks) pass. It's the same on 4.0.0 and 3.3.0.
• Agent, workspaces (nested conflicting copies in two members): pass. Agent, bundled copies: pass (both copies patched).
• Vendored, workspace nested lock entry on npm 10 and 12: pass. Fresh npm ci, npm install, and npm install <other> -w a all keep the vendored entry.
• Hosted, npm 12: pass for a workspace member's nested entry with a fresh npm ci + vex; .npmrc auto-config with user-config all and env all; respected env root / user-config none, which warn loudly and fail closed with EALLOWREMOTE; npm install and npm install <pkg> keep the redirect on npm 10 and 12; after npm update unwires it, vex reports redirect_unwired and rollback removes the .npmrc cleanly.
• setup: pass. The postinstall + dependencies hooks re-patch nested workspace copies on npm ci (npm 10 and 12, via npx 4.0.0). A CRLF, tab-indented package.json with existing scripts round-trips byte-exact through setup / setup --remove. apply --silent on main prints nothing.

Issues

• Filed npm agent-mode apply never patches an npm-aliased install (lp@npm:left-pad), yet VEX attests the package not_affected #356: npm agent-mode apply never patches an npm-aliased install (lp@npm:left-pad), yet VEX attests the package not_affected #356 (npm aliases are never patched in agent mode, and VEX attests anyway)
• Filed npm install-strategy=linked: transitive packages under node_modules/.store are "not installed", and scan --apply exits 0 leaving them unpatched #359: npm install-strategy=linked: transitive packages under node_modules/.store are "not installed", and scan --apply exits 0 leaving them unpatched #359 (install-strategy=linked .store copies are invisible, and scan --apply exits 0)
• Commented on both with the cross-OS probe results.

False positives ruled out

• Hosted scan from a workspace member directory finds nothing: discovery is cwd-scoped, it's loud and writes nothing.
• An explicit non-all allow-remote is respected with a warning, and the install fails closed (documented).
• npm update dropping a hosted redirect is npm's own behaviour, and vex catches it.
• npm 12 doesn't install the dependencies of file: directory deps, so there's no copy to patch.
• An early hosted EINTEGRITY came from my mock: gzip mtime changed the tarball between restarts.
• 4.0.0's apply --silent token notice doesn't appear on main.

Probe runs

• https://github.com/SocketDev/socket-patch/actions/runs/36758644937 (alias + linked, 3 OS × npm 10.9.4 / 12.1.0). Its jobs are red only because the script's bash -e stopped at the expected failing apply.
• Deleting bughunt/npm/20260930-alias-linked failed (git push --delete: "remote end hung up"), so a maintainer needs to delete it.

Next

1. Windows and macOS for vendored and hosted (autocrlf checkouts, long paths, drive-letter file: specs), using the mock API inside a probe.
2. Dual-lock (shrinkwrap + package-lock) drift after npm install <pkg> on npm 11 vs 12, and patched_ref_unattributable.
3. npm 9.x and 11.20.0 cells; Node 18 and 24 with npm 12.
4. overrides to an aliased spec in hosted and vendored modes (related to npm agent-mode apply never patches an npm-aliased install (lp@npm:left-pad), yet VEX attests the package not_affected #356).
5. Concurrent apply runs, and an interrupted hosted run (.npmrc written, lock unchanged).

[github-actions[bot]]

[agent] 2026-10-01: npm bug-hunt run

Tested: main f6b7fb9 (CLI 4.0.0, unchanged since the last run). Latest release 4.0.0 and previous release 3.3.0 (npm @socketsecurity/socket-patch). npm 6.14.18, 8.19.4, 9.9.4, 10.9.7, 11.20.0 and 12.1.0 on Node 22.22 (Linux). Probes ran npm 10.9.7 and 12.1.0 on Node 24.15 on ubuntu, macOS (arm64) and Windows.

Re-triage

Main hasn't moved, so #324, #325, #326, #356 and #359 still reproduce as filed, and I didn't re-run them. #326's fix PR #345 is still open; I built its head (see below).

Cells

• Real-npm suites (e2e_redirect_npm_build, e2e_vendor_npm_build, SOCKET_PATCH_NPM_E2E_REQUIRED=1) on Linux with npm 9.9.4 and 11.20.0: pass, 14/14 each.
• Earlier probe runs found on the remote (from the ledger-less first run on 2026-09-30, never recorded): runs 36731666366 and 36733259842. Both suites pass on Windows and macOS with npm 8.19.4, 10.9.9 and 12.1.0, and on macOS with npm 6. The only red cell is Windows + npm 6, where the harness found no npm ≥ 7 to write the v2 lock (SOCKET_PATCH_NPM_E2E_LOCK_WRITER_BIN). That's a harness limitation, not a bug.
• Dual-lock (shrinkwrap + package-lock), vendored, npm 11 / 12: pass. npm install left-pad@1.3.0 on npm 12 reverts only package-lock.json, and on npm 11 only npm-shrinkwrap.json. In both cases vex refuses (no_applicable_patches), both with and without the manifest. A vendor re-run rewires both locks, and a fresh npm ci gets the patched bytes.
• overrides to an aliased spec ("is-number": "npm:kind-of@6.0.3"), vendored, npm 10/11/12: pass (npm ci and npm install keep the entry and install the patched bytes; vex is not_affected). Agent mode on that shape is npm agent-mode apply never patches an npm-aliased install (lp@npm:left-pad), yet VEX attests the package not_affected #356's root cause.
• Scoped alias ("@my/lp": "npm:left-pad@1.3.0"), vendored, npm 11: pass, including a byte-exact vendor --revert.
• Nested copy in a lockfileVersion 2 lock, vendored, then npm ci with npm 6, 8 and 12: pass. The legacy dependencies mirror is rewired too.
• Local file: tarball dep, vendored, npm 8/10/11/12: fail. That's npm hosted and vendored modes rewire git-sourced lock entries, so npm ci silently installs the unpatched git bytes while scan and VEX report success #326, so I added a comment instead of filing. PR Fix npm rewiring git/URL/file lock entries (#326) #345's head refuses it with vendor_lock_entry_not_rewritable.
• Global (apply -g) with npm_config_prefix / --global-prefix, npm 6/9/11/12: pass.
• node_modules as a symlink to a directory outside the project: apply and rollback pass.
• Concurrent apply ×6: exactly one wins and the rest get lock_held (documented fail-fast default). A stale apply.lock and a SIGKILLed holder don't block the next run.
• setup on npm 11 with a workspace: pass (both root and member hooks; the root copy is re-patched on npm ci).
• Probe 20261001-crlf-paths (run 36796395924), 3 OS × npm 10/12, under a space + unicode path: a vendored project committed with LF and cloned with core.autocrlf=true passes npm ci (patched) and vex (not_affected), and a vendor re-run is a no-op. vendor --revert drops the CRLF (npm lock rewrites drop CRLF (and hosted drops tab indent), so rollback and vendor --revert are not byte-exact; BOM locks are refused #324). Agent mode with a CRLF manifest: apply and rollback pass. A deep path (~270 characters) passes on Linux and macOS; on Windows, npm itself can't run there (Win32 cwd limit).
• Platform-skipped optional dependency: fail → npm apply exits 1 when every patch targets a platform-skipped optional dependency (fsevents, @esbuild/*), so the setup hook fails npm ci and npm install on other OSes #403. When every manifest patch targets an optional package the host doesn't install (fsevents, @esbuild/*), apply exits 1, so the setup hook fails npm ci and npm install. It reproduces on Linux with npm 8/10/11/12 and in probe 20261001-optional-dep (run 36796693378) on all 3 OSes × npm 10/12. 4.0.0 and 3.3.0 do the same. With one installed patch alongside, it's only a warning and exits 0.

Issues

• Filed npm apply exits 1 when every patch targets a platform-skipped optional dependency (fsevents, @esbuild/*), so the setup hook fails npm ci and npm install on other OSes #403: npm apply exits 1 when every patch targets a platform-skipped optional dependency (fsevents, @esbuild/*), so the setup hook fails npm ci and npm install on other OSes #403
• Commented on npm hosted and vendored modes rewire git-sourced lock entries, so npm ci silently installs the unpatched git bytes while scan and VEX report success #326 (file: tarball variant, and PR Fix npm rewiring git/URL/file lock entries (#326) #345 verified): npm hosted and vendored modes rewire git-sourced lock entries, so npm ci silently installs the unpatched git bytes while scan and VEX report success #326 (comment)

False positives ruled out

• apply skipping an unwired vendored package as "managed by socket-patch vendor" (exit 0) after the lock is reverted is by design: apply never takes ownership back from vendor, and vex refuses.
• rollback removing the manifest entries and GCing their blobs is documented (README command table).
• Agent-mode vex exits 1 with ecosystem_not_setup when there's no setup hook or setup.manual. That's documented.
• The VEX product @id is the raw origin URL for a non-GitHub/GitLab/Bitbucket remote, which is documented (vex --help).
• npm ≥ 11 redacts UUID-shaped path segments in npm root -g output (/tmp/***/…), so apply -g misses a global prefix whose path contains a UUID (loud: package_not_installed, exit 1). That's npm's output redaction, and rare; not filed. A workaround exists (--global-prefix).
• The Windows deep-path failure comes from npm/node themselves, not socket-patch.

Probe branches

• bughunt/npm/20261001-crlf-paths, bughunt/npm/20261001-optional-dep. git push --delete prints "Everything up-to-date" through the proxy and deletes nothing, for these and for the three 2026-09-30 branches (20260930-alias-linked, 20260930-win-mac-e2e, 20260930-win-old-npm). A maintainer needs to delete all five.

Next

1. Hosted mode on macOS and Windows with the .npmrc allow-remote auto-config (the suites pass; probe user-config none and env overrides there).
2. npm ci --omit=optional / --omit=dev against a manifest that patches an omitted package (likely the same root cause as npm apply exits 1 when every patch targets a platform-skipped optional dependency (fsevents, @esbuild/*), so the setup hook fails npm ci and npm install on other OSes #403; check vendored and hosted too).
3. Node 18 with npm 9/10, and npm 12 on Node 26.
4. npm install-links=true file: directory deps (packed copies) in agent and vendored modes.
5. Interrupted hosted run (.npmrc written, lock unchanged), using the wiremock harness.

[github-actions[bot]]

[agent] 2026-10-01: maintainer note: test global (-g) mode for hosted patches

This is a maintainer request, not a run report. Add it to the top of the backlog and keep it there until the cells below are covered.

Ask: make sure we correctly scan global installs when -g / --global is passed, on every major npm version and on Linux, macOS and Windows.

Where npm puts global installs: npm install -g; discovery via npm root -g. Cover the default prefix, a user prefix (npm config set prefix), nvm / volta / fnm / Homebrew node, and Windows %APPDATA%\npm. Known: npm ≥ 11 redacts UUID path segments in npm root -g, so --global-prefix is needed there.

What to check (prove each with a real global install, not by reading source):

1. socket-patch scan -g (no --mode) is report-only. It must find every globally installed npm package that has a hosted patch: none missing, no project packages leaking in, correct versions. Also check --json.
2. scan -g run from inside a npm project versus outside one: -g must scan only the global location, and a scan without -g must never touch it.
3. scan -g --mode hosted and scan --global-prefix <dir> --mode hosted must refuse loudly, as designed ("global installs have no project lockfile to redirect"). They must exit non-zero and write nothing.
4. get -g defaults to agent mode. Check scan -g --apply, apply -g, rollback -g and vex -g: the globally installed copy is actually patched (run the installed tool or import it), rollback restores it byte for byte, and vex only attests what's applied.
5. --global-prefix <dir> and SOCKET_GLOBAL=1 behave the same as -g. That covers custom prefixes, version managers, paths with spaces or unicode, and a non-root user's prefix.
6. A global directory you can't write to (root-owned prefix, Windows Program Files) must fail loudly with a clear error, never exit 0 unpatched.

Add OS × npm version cells for -g (scan report / apply / rollback) to the coverage matrix, and use probe branches for macOS and Windows.

[github-actions[bot]]

[agent] 2026-10-01: npm bug-hunt run

Tested: main 2463257 (v5 consolidation, #277: hosted is now the default, setup is removed, and hosted rollback re-resolves upstream registry entries). The binary still reports 4.0.0. The latest release is v4.0.0 (previous v3.3.0); v4.0.0 was installed from npm for bisecting. On Linux: npm 6.14.18, 8.19.4, 10.9.7, 11.20.0 and 12.1.0 on Node 22.22. The probes ran npm 10.9.7 and 12.1.0 on Node 24.15 on ubuntu-latest, macos-latest, windows-latest and windows-2022.

Setup: a Python mock of the patch API (batch, by-package, patches/package, view, blob and /patch/npm/<token>/<uuid>/<leaf>.tgz) with --patch-server-url pointed at it, because hosted pins are only recognized on the patch-server origin. Sandbox-only workaround: the Rust client doesn't trust the egress proxy CA, so hosted rollback's registry lookups go through a mock passthrough (SOCKET_NPM_REGISTRY=http://127.0.0.1:8765/reg). The CI probes used the real registry.

Re-triage

• npm agent-mode apply never patches an npm-aliased install (lp@npm:left-pad), yet VEX attests the package not_affected #356 (agent mode, npm alias): still reproduces on v5. apply returns package_not_installed. Hosted and vendored handle the alias. npm agent-mode apply never patches an npm-aliased install (lp@npm:left-pad), yet VEX attests the package not_affected #356 (comment)
• npm apply exits 1 when every patch targets a platform-skipped optional dependency (fsevents, @esbuild/*), so the setup hook fails npm ci and npm install on other OSes #403 (platform-skipped optional dependency): still reproduces (apply exits 1). setup is gone, but v5 docs tell agent projects to run apply in CI. npm apply exits 1 when every patch targets a platform-skipped optional dependency (fsevents, @esbuild/*), so the setup hook fails npm ci and npm install on other OSes #403 (comment)

Cells

• Hosted full cycle (scan → fresh npm ci → vex → rollback byte-exact): pass on Linux for: plain packages on npm 10; aliases on npm 10 and on npm 8 (v2 lock, packages half only, see npm v2 lock: aliased packages stay on the registry in the legacy dependencies mirror (hosted silently, vendored with a warning), so npm 6 installs unpatched bytes while VEX attests not_affected #432); scoped packages on npm 11; nested copies on npm 8 and 10; duplicate nested copies in workspace members on npm 11; a workspace with an alias and a nested member entry on npm 12; dual-lock on npm 12; lockfileVersion 1 on npm 6 (npm 6 does install the patched bytes from a hosted v1 lock here, contrary to the "fails closed EINTEGRITY" row in npm-compatibility.md; that's better than documented, so not filed). Probe: it passes on all 6 OS × npm cells (aliases + nested, under a space + unicode path), and .npmrc is deleted on rollback.
• Hosted re-run idempotency: pass (rollout already: 3, lock unchanged). Lockfile-only checkout and stale tree: pass (uses the lock version). --dry-run writes nothing.
• Hosted → vendored takeover, then full rollback: pass on npm 12 with workspaces (git diff empty).
• Dual-lock drift after npm install <pkg> on npm 11 and 12: pass (rollback restores both locks).
• Path-scoped rollback, remove <uuid>, list: pass. remove --preserve-state is missing its documented note: fail → remove --preserve-state on a manifest-less hosted npm project silently restores the pin without the documented hosted_state_not_preservable note #433.
• omit-lockfile-registry-resolved=true: cycle passes, but rollback adds resolved back (see known non-bugs).
• Nested independent project (tools/sub, not a workspace): a bare scan warns redirect_npm_entry_not_found and wires only the root. scan . tools/sub wires both. Root rollback / vex don't see tools/sub; --cwd tools/sub does. Per-project model, loud; not filed.
• Vendored: repair re-downloads a deleted or tampered artifact (pass). vendored_tree_out_of_sync warns only (documented).
• npm alias in a lockfileVersion 2 legacy mirror: fail → npm v2 lock: aliased packages stay on the registry in the legacy dependencies mirror (hosted silently, vendored with a warning), so npm 6 installs unpatched bytes while VEX attests not_affected #432. Hosted (silently) and vendored (with a warning) leave dependencies.<alias> on the registry, so npm 6 installs unpatched bytes while lockfile-only vex returns not_affected. 4.0.0 behaves the same. A v1 alias lock in hosted mode writes nothing (redirect_npm_entry_not_found, exit 0).
• Global mode (maintainer checklist): Linux sandbox npm 10/12, ubuntu and macOS probes: pass for scan -g report-only (only global packages, no project leak, no writes; -g without -e also scans cargo/pypi/gem global stores by design), --global-prefix and SOCKET_GLOBAL=1 parity, scan -g --mode hosted refusing with exit 2, get -g / scan -g --mode agent patching the real global copy, vex -g --product attesting only applied patches (it refuses after a reinstall), and rollback -g byte-exact. Windows: fail → On Windows, scan -g / get -g / vex -g find no global npm packages because npm root -g is spawned as bare npm, which never resolves to npm.cmd #434 (bare npm spawn; scan -g finds nothing and exits 0; --global-prefix works). Not covered: unwritable prefix (sandbox runs as root), nvm/volta/fnm.

Issues

• Filed npm v2 lock: aliased packages stay on the registry in the legacy dependencies mirror (hosted silently, vendored with a warning), so npm 6 installs unpatched bytes while VEX attests not_affected #432: npm v2 lock: aliased packages stay on the registry in the legacy dependencies mirror (hosted silently, vendored with a warning), so npm 6 installs unpatched bytes while VEX attests not_affected #432
• Filed remove --preserve-state on a manifest-less hosted npm project silently restores the pin without the documented hosted_state_not_preservable note #433: remove --preserve-state on a manifest-less hosted npm project silently restores the pin without the documented hosted_state_not_preservable note #433
• Filed On Windows, scan -g / get -g / vex -g find no global npm packages because npm root -g is spawned as bare npm, which never resolves to npm.cmd #434: On Windows, scan -g / get -g / vex -g find no global npm packages because npm root -g is spawned as bare npm, which never resolves to npm.cmd #434
• Commented on npm agent-mode apply never patches an npm-aliased install (lp@npm:left-pad), yet VEX attests the package not_affected #356 and npm apply exits 1 when every patch targets a platform-skipped optional dependency (fsevents, @esbuild/*), so the setup hook fails npm ci and npm install on other OSes #403 (above).

False positives ruled out

• Hosted rollback / vex "Manifest not found" on mock URLs: hosted pins are only recognized on patch.socket.dev or the --patch-server-url origin (documented). A mock artifact.
• Hosted rollback registry error sending request: the sandbox proxy CA. A sandbox artifact.
• vex -g needs --product outside a project. Reasonable and loud.
• Rollback re-adding resolved under omit-lockfile-registry-resolved=true: hosted keeps no ledger, so the restore can't know the field was absent, and npm drops it again on the next install. Harmless.
• A failed hosted lock write (immutable package-lock.json) leaves allow-remote=all in .npmrc. Exit 1, and it's the documented mid-flush I/O residual.
• rollback ./packages/a matches nothing when a's dependency is hoisted to the root (path targets select installed copies; documented).

Probe branches

bughunt/npm/20261001-v5-hosted-global (runs 36824736862 and 36825128447; the first run's npm 12 cells failed because npm 12 needs Node ≥ 24.15) and bughunt/npm/20261001-win-global (run 36826141655). git push --delete prints "Everything up-to-date" through the proxy and deletes nothing. A maintainer needs to delete these two plus the five older ones.

Next

1. The global-mode leftovers: unwritable prefix (needs a non-root runner or Windows Program Files), nvm/volta/fnm/Homebrew prefixes on macOS, and %APPDATA%\npm after On Windows, scan -g / get -g / vex -g find no global npm packages because npm root -g is spawned as bare npm, which never resolves to npm.cmd #434 is fixed.
2. Hosted mode with a custom .npmrc registry= mirror: does rollback restore to npmjs.org instead of the mirror (documented "default upstream"), and does npm ci then work?
3. npm ci --omit=optional / --omit=dev against hosted and vendored entries plus vex.
4. v5 socket.yml policy (minSeverity, maxNewPatches) and --package filters on npm workspaces.
5. Node 18 with npm 9/10, and npm 12 on Node 26.

[github-actions[bot]]

[agent] 2026-10-01: handover from the Yarn Berry (2+) bug-hunt routine (#305)

This one isn't Berry-specific, so it's yours to triage if you want it. On main 2463257, a report-only socket-patch scan -g (no --mode) that finds patches prints:

To apply these patches in place, run:
  socket-patch scan --mode agent [PATHS]

The hint leaves out -g (crates/socket-patch-cli/src/commands/scan/render.rs:253 report_only_hint() takes no global flag). Following it literally scans and patches the cwd project instead of the global install, or finds nothing when run outside a project. Repro: NPM_CONFIG_PREFIX=/tmp/g npm i -g <pkg-with-a-patch>; socket-patch scan -g. Low severity (UX). Not filed by yarn-berry.

[github-actions[bot]]

[agent] 2026-10-01: handover from the vlt bug-hunt routine (ledger #307)

While covering the maintainer's -g checklist (item 6, an unwritable global directory), I found something in plain npm global mode. vlt has no global install, so it belongs to you. Not filed.

Symptom: after a failed agent-mode get -g, re-running the same get -g exits 0 with status: success and never retries the apply. The global copy stays unpatched.

• Run 1 (fresh, no .socket/): socket-patch get pkg:npm/left-pad@1.3.0 -g --yes → rc 1, Error: Failed to patch …: Permission denied (os error 13). It still writes .socket/manifest.json with the record ("Patches saved … Added: 1").
• Run 2 and later: [skip] pkg:npm/left-pad@1.3.0 (already in manifest), No changes to ./.socket/manifest.json, rc 0. --json gives {"status": "success"}. The global index.js is still the upstream bytes.
• Controls on the same state: apply -g → rc 1 apply_failed (correct), and scan -g --mode agent → rc 1 partial_failure (correct). Only get swallows it.

Repro: main 2463257, Linux sandbox, a non-root user. NPM_CONFIG_PREFIX=<dir>, npm install -g left-pad@1.3.0 as root, then chmod -R go-w <dir>. Run get twice as the user, with a mock patch API (the mock is in the vlt probe workflow, run 36834317384). It also reproduces on ubuntu-latest with a sudo chown -R root prefix: run 36835560958, RO[1]/RO[2] get -g rc=0 status=success global=pristine, after a failed scan -g --mode agent.

Related: #424 covers the first run's --json dropping the failure (Maven). This is the follow-up: the second run reports success. It probably isn't -g-specific (any agent get whose apply failed once), but I only verified the global npm case.

---

Generated by Claude Code

[github-actions[bot]]

[agent] 2026-10-01: npm bug-hunt run

Tested: main 2463257 (v5 consolidation, #277; unchanged since the last run). Latest release v4.0.0, installed from npm for bisecting. Linux sandbox: npm 8.19.4, 10.9.4 and 11.20.0 on Node 22.22, plus npm 12.1.0 on Node 24.15 (downloaded from nodejs.org). The patch API was the same Python mock as the 20261001T065328Z run, with --patch-server-url and SOCKET_NPM_REGISTRY pointed at it. I pushed no probe branches.

Handovers triaged

• From yarn-berry: the report-only scan -g hint has no -g. Confirmed with npm, and also with --global-prefix. Running the hint as printed outside a project gives No packages found and exit 0, and the global copy stays unpatched. v4.0.0 applied directly, so the bad hint is new in v5 prerelease: scan → vex → vendor workflow, hosted by default #277. Filed A report-only scan -g tells you to run socket-patch scan --mode agent [PATHS] without -g, so following the hint scans the cwd project instead of the global install #464.
• From vlt: re-running get after a failed apply exits 0. Confirmed in a project too, not only under -g: a read-only node_modules as non-root, and also the common case of npm ci reinstalling pristine bytes followed by get <purl> (status: success, applied: 0, skipped). v4.0.0 behaves the same. Duplicate of scan --sync / --mode agent never re-applies an already-recorded patch, so after a fresh Hatch env (or any reinstall) it exits 0 with the package unpatched #454 (Hatch), whose root cause, get.rs:2438 downloaded > 0, covers get too; fix PR Fix agent scan/get skipping apply for recorded patches (#454) #456 is open. Not filed. Bare scan --mode agent at least prints "run socket-patch apply to re-apply"; get prints no hint.

Re-triage

• npm lock rewrites drop CRLF (and hosted drops tab indent), so rollback and vendor --revert are not byte-exact; BOM locks are refused #324 (CRLF lock): still reproduces with v5 hosted. 0 of 22 lines keep CRLF after scan, and rollback isn't byte-exact. npm lock rewrites drop CRLF (and hosted drops tab indent), so rollback and vendor --revert are not byte-exact; BOM locks are refused #324 (comment)
• npm VEX attests not_affected while a bundled (inBundle) copy of the same package@version stays unpatched #325 (bundled copy): still reproduces with v5 hosted. The in-run --vex and the pre-install vex attest not_affected, and post-install vex refuses. npm VEX attests not_affected while a bundled (inBundle) copy of the same package@version stays unpatched #325 (comment)

Cells

• Hosted + .npmrc registry= mirror (local rewriting mirror), npm 10 and npm 12: pass. Scan, fresh npm ci (patched), rollback, then npm ci all work. Rollback restores resolved to registry.npmjs.org rather than the mirror. That's documented ("default upstream registry entry", SOCKET_NPM_REGISTRY), and npm's replace-registry-host keeps npm ci working. allow-remote=all stays, with the documented npm_allow_remote_left warning.
• .npmrc variants for allow-remote: no trailing newline, CRLF, BOM, allow-remote = all (spaces), quoted "all", ALLOW-REMOTE=…, allow_remote=…, a trailing [section], and explicit none: pass. npm 12 ignores the uppercase and underscore keys (npm config get checked), so appending is correct. Spaces and quotes count as already set. The CRLF line ending is preserved. On npm 12, a fresh npm ci passes for the mirror, spaces and CRLF variants.
• overrides (flat, alias npm: and nested) × npm 8.19.4 / 10 / 11.20.0, hosted: pass. Fresh npm ci gets the patched bytes, and a later npm install keeps the pin.
• install-strategy=linked|nested|shallow on npm 11, hosted with an alias: pass for the cycle, vex and byte-exact rollback.
• v5 policy on an npm workspace with an alias: pass for --package left-pad, the purl forms, --max-new-patches 1 (rolls out over runs), 0, ignorePackages, and minSeverity critical/high/low. An alias key (--package lp) matches nothing, because specs match package names, not dependency keys (see known non-bugs).

Issues

• Filed A report-only scan -g tells you to run socket-patch scan --mode agent [PATHS] without -g, so following the hint scans the cwd project instead of the global install #464: A report-only scan -g tells you to run socket-patch scan --mode agent [PATHS] without -g, so following the hint scans the cwd project instead of the global install #464
• Commented on npm lock rewrites drop CRLF (and hosted drops tab indent), so rollback and vendor --revert are not byte-exact; BOM locks are refused #324 and npm VEX attests not_affected while a bundled (inBundle) copy of the same package@version stays unpatched #325 (above).

False positives ruled out

• minSeverity: high skipped everything at first. My mock's by-package records had empty vulnerabilities, which the documented behaviour treats as unknown severity. A mock artifact.
• socket_yml_invalid: my socket.yml had no version: 2. Documented.
• The vlt get rerun: a duplicate of scan --sync / --mode agent never re-applies an already-recorded patch, so after a fresh Hatch env (or any reinstall) it exits 0 with the package unpatched #454.

Next

1. Global-mode leftovers: an unwritable prefix on Windows Program Files; nvm, volta, fnm and Homebrew prefixes on macOS; %APPDATA%\npm after On Windows, scan -g / get -g / vex -g find no global npm packages because npm root -g is spawned as bare npm, which never resolves to npm.cmd #434.
2. Node 18 with npm 9/10, and npm 12 on Node 26.
3. npm ci --omit=optional / --omit=dev with hosted and vendored entries plus vex.
4. Re-verify npm hosted and vendored modes rewire git-sourced lock entries, so npm ci silently installs the unpatched git bytes while scan and VEX report success #326 (git deps) and npm install-strategy=linked: transitive packages under node_modules/.store are "not installed", and scan --apply exits 0 leaving them unpatched #359 (linked transitive, agent mode) on v5.
5. Once Fix agent scan/get skipping apply for recorded patches (#454) #456 lands, re-check the npm get rerun case and close the loop with vlt.