Bug hunt ledger: npm

[Mikola Lysenko (mikolalysenko)]

[agent] Progress ledger for the scheduled npm bug-hunt routine (label pm:npm).

Last updated: 2026-10-02 (run 8 with a ledger), main 61cfb9b (v5 + the #324/#325/#326/#359/#454 fixes; the binary still reports 4.0.0), latest release v4.0.0 (previous v3.3.0, both from npm @socketsecurity/socket-patch). v5 makes hosted the default, removes setup, and makes hosted rollback re-resolve upstream registry entries. Cells marked (v4) were last verified on f6b7fb9.

Coverage matrix

Cells are "pass", "fail #N" or "untested". Every cell uses a real npm install. Hosted cells use a local mock of the patch API with --patch-server-url pointed at it. Agent and vendored cells use the same mock or a hand-staged .socket/. "Cycle" means scan → fresh npm ci → vex → rollback byte-exact. "Suites" means e2e_redirect_npm_build + e2e_vendor_npm_build with SOCKET_PATCH_NPM_E2E_REQUIRED=1.

OS	npm	Agent (apply / scan --mode agent)	Vendored	Hosted (v5 default)	Global -g (scan report / get+apply / vex / rollback)
Linux	6.14.18	fail #356 (v4). pass: -g (v4)	pass: nested v2 lock (v4). v1 lock refused loudly (documented). fail #432 (alias mirror)	pass: v1-lock cycle (npm 6 installs the patched bytes), shrinkwrap-only v1 cycle. v1 alias: not wired (#432)	pass (v4)
Linux	7.0.15 / 7.24.2	pass: scan/apply, vex, npm ci → vex refuses, re-apply, rollback	pass: cycle + --omit=dev, workspaces, vendored↔hosted takeover, revert byte-exact	pass: cycle (alias, nested, dev), workspaces, takeovers	untested
Linux	8.19.4	fail #356 (v4), #403 (v4), #516 (vex, duplicate nested copies)	fail #432. pass: cycle + --omit=dev, workspaces, takeovers, rescan no-op	pass: nested v2 cycle, shrinkwrap-only, workspaces, takeovers, rescan no-op, overrides (flat, alias, nested). fail #432 (alias mirror, npm 6 consumer), #490 (override over a git spec)	untested
Linux	9.9.4	pass -g (v4); Node 18 cycle	pass: cycle + --omit=dev (main), Node 18 cycle	pass: cycle (alias, nested, dev), Node 18 cycle	pass (v4)
Linux	10.8.2 (Node 18) / 10.9.x	pass: Node 18 cycle. fail #554 (socket.yml path policy, nested projects), #356, #403 (re-checked on 61cfb9b; also npm ci --omit=dev), #516 (vex, duplicate nested copies). pass: bundled copy (both copies patched + vex)	pass: CRLF / BOM / tab layout cycle (#324 fixed), --omit=dev, agent↔vendored takeovers. fail #490	pass: cycles (plain, alias, nested), npm ci --omit=dev + vex, shrinkwrapped file: dep, JSONStream, agent↔hosted takeovers, stale tree, lockfile-only, dry-run, rescan no-op, nested project (loud), registry= mirror, .npmrc variants, overrides (incl. $ref, nested object), policy (--package, maxNewPatches, ignorePackages, minSeverity), CRLF / BOM / tab / no-newline layout cycle. fail #490, #325 (in-run --vex only, reopened)	pass: all four, --global-prefix, SOCKET_GLOBAL, --mode hosted refused. fail #464 (report-only hint has no -g)
Linux	11.20 / 11.21	pass (v4); linked .store scoped transitive (11.21, #359 fixed). fail #403 (v4)	pass (v4). fail #490 (11.21)	pass: scoped, duplicate nested workspace copies, dual-lock drift, omit-lockfile-registry-resolved, overrides, install-strategy=linked/nested/shallow	untested
Linux	12.1 / 12.2.0	fail #356, #403 (v4), #516, #554 (12.2.0)	pass: hosted→vendored takeover + rollback, --omit=dev, workspaces, remove in a workspace, Node 26, repair, BOM+CRLF / tab cycle (12.2.0)	fail #490 (12.2.0). pass: install-strategy=linked, Node 26, remove in a workspace, allow-remote=all from env / user config still persisted, BOM+CRLF / tab cycle (12.2.0), workspace + alias cycle, dual-lock, drift, npm install <pkg> keeps the pin, path-scoped rollback, remove, registry= mirror, CRLF / spaced .npmrc. fail #433	pass: all four
macOS	10.9.7	pass: linked .store apply/vex/rollback (main, #359 fixed). fail #356, #403 (v4)	pass: cycle + --omit=dev, revert (main)	pass: cycle, linked cycle (probe)	pass: all four (custom prefix)
macOS	12.1.0 / 12.2.0	pass: linked .store apply/vex/rollback (main, #359 fixed). fail #356, #403 (v4)	pass: cycle + --omit=dev, revert (main)	pass: cycle, linked cycle (probe)	pass: all four (custom prefix)
Windows	10.9.7	pass: linked .store apply/vex/rollback (main). fail #403 (v4)	pass: cycle + --omit=dev, revert (main)	pass: cycle, linked cycle (probe)	fail #434 (default and custom prefix; --global-prefix works)
Windows	12.1.0 / 12.2.0	pass: linked .store apply/vex/rollback (main). fail #356, #403 (v4)	pass: cycle + --omit=dev, revert (main)	pass: cycle, linked cycle (probe)	fail #434
Windows 2022	10.9.7 / 12.2.0	pass: linked .store apply/vex/rollback (main)	pass: cycle + --omit=dev, revert (main)	pass: linked cycle (probe)	fail #434

Backlog

1. Agent-mode scan ignores socket.yml includePaths / ignorePaths (and the built-in tests/ default) for nested npm projects, patching every nested project's node_modules #554 follow-ups: agent rollback / vex with path policy over nested projects.
2. npm hosted and vendored modes refuse a registry-installed package when its dependent's git spec is replaced by an overrides entry (regression from #345) #490 / Agent-mode npm vex hashes only the first installed copy of a package, so it attests not_affected while another nested copy of the same name@version is unpatched #516 / npm VEX attests not_affected while a bundled (inBundle) copy of the same package@version stays unpatched #325 / Vendored vlt scan exits 1 after the patched dependency is upgraded or uninstalled, and even scan --prune exits 1 while it reverts the stale entry #541 re-checks once main moves (PRs Fix agent vex checking only one installed copy (#516) #517, Fix vendored rescans failing on unwired ledger entries (#541) #543 pending); then overrides over URL / file: transitive deps on npm 8–12 ($ref and nested objects pass on npm 10).
3. Hosted in-run --vex against other contested shapes (npm VEX attests not_affected while a bundled (inBundle) copy of the same package@version stays unpatched #325): a git copy only in the shrinkwrap, bundles inside workspace members.
4. Agent-mode npm vex hashes only the first installed copy of a package, so it attests not_affected while another nested copy of the same name@version is unpatched #516 follow-ups: agent vex with duplicate copies across workspace members and in install-strategy=linked .store peer variants.
5. Maintainer request (global -g), still open: npm 6/8/11 on macOS and Windows; an unwritable prefix (root-owned / Program Files); nvm, volta, fnm and Homebrew prefixes on macOS; %APPDATA%\npm once On Windows, scan -g / get -g / vex -g find no global npm packages because npm root -g is spawned as bare npm, which never resolves to npm.cmd #434 is fixed. Full checklist in the 20261001T040000Z entry.
6. Stale probe branches the proxy can't delete (git push --delete fails with "remote end hung up" / "Everything up-to-date"): bughunt/npm/20260930-alias-linked, 20260930-win-mac-e2e, 20260930-win-old-npm, 20261001-crlf-paths, 20261001-optional-dep, 20261001-v5-hosted-global, 20261001-win-global, 20261002-v5-agent-vendored-winmac. A maintainer needs to delete them.

Known non-bugs

• patches-api.socket.dev is unreachable from the sandbox. Use hand-staged manifests, a local mock API, or the wiremock suites.
• Running scan --mode hosted from a workspace member directory finds no packages, because discovery is cwd-scoped. It's loud and writes nothing.
• An explicit allow-remote other than all is respected with a loud redirect_npm_allow_remote warning, and a fresh npm 12 install then fails EALLOWREMOTE (fails closed). This is documented.
• npm update re-resolves a hosted or vendored entry back to the registry. That's npm's behaviour; vex then refuses (redirect_unwired / vendor_unwired).
• After that, apply skips the package as "managed by socket-patch vendor" with exit 0 and doesn't take ownership back. That's by design (apply.rs VENDOR_OWNED_MARKER), and vex refuses.
• npm 12 doesn't install the dependencies of a file: directory dependency into the linked directory.
• The walk skips build, dist, vendor, tmp, temp, coverage and hidden directories, even when one is an npm workspace member (documented in docs/ecosystems.md).
• apply from a workspace member directory reports noManifest when .socket/ lives at the root (--cwd scoping).
• Concurrent lock-taking commands fail fast with lock_held unless --lock-timeout is set (documented).
• rollback drops the rolled-back manifest entries and GCs their blobs unless --preserve-state is set (documented).
• Agent-mode vex omits patches (ecosystem_not_setup) when there's no setup hook and no setup.manual (documented).
• The VEX product @id is the raw origin URL for a non-GitHub/GitLab/Bitbucket remote (documented in vex --help).
• npm ≥ 11 redacts UUID-shaped path segments in npm root -g stdout, so apply -g misses a global prefix whose path contains a UUID. That's npm's behaviour, it's loud (exit 1), and --global-prefix works around it. Not filed.
• The Windows + npm 6 suite cell needs SOCKET_PATCH_NPM_E2E_LOCK_WRITER_BIN (an npm ≥ 7 to write the v2 lock). That's a harness requirement.
• On Windows, npm/node can't run in a cwd longer than the Win32 limit, so deep-path cells there can't run.
• Hosted pins on any host other than patch.socket.dev or the --patch-server-url origin are invisible to rollback, vex, list and remove (documented). Mock runs must pass --patch-server-url.
• In the sandbox, hosted rollback can't reach registry.npmjs.org (the Rust client doesn't trust the proxy CA). Use SOCKET_NPM_REGISTRY pointed at a local passthrough.
• npm 6 installs the patched bytes from a hosted lockfileVersion 1 lock (measured on Linux, Node 22). npm-compatibility.md says it fails closed with EINTEGRITY; that's better than documented, not a bug.
• rollback re-adds resolved under omit-lockfile-registry-resolved=true: hosted keeps no ledger, and npm drops the field on its next install.
• A failed hosted lock write (an immutable lock) leaves allow-remote=all in .npmrc: exit 1, the documented mid-flush I/O residual.
• A bare hosted scan wires only the cwd project's lock. A nested non-workspace project warns redirect_npm_entry_not_found. scan . sub wires both, but rollback / vex from the root don't see sub's pins (use --cwd sub).
• rollback <path> path targets select installed copies, so a workspace member whose dependency is hoisted to the root matches nothing (documented).
• Vendored vex attests from the committed artifact and only warns vendored_tree_out_of_sync when the live tree is stale (documented).
• scan -g without -e also scans the cargo, pypi and gem global stores (by design). vex -g outside a project needs --product.
• v5 removes setup, so the setup-hook cells are retired.
• Hosted rollback restores resolved to registry.npmjs.org (or SOCKET_NPM_REGISTRY) even when the project .npmrc uses a registry= mirror. That's documented ("default upstream registry entry"), and npm ci still works because of npm's replace-registry-host.
• --package and ignorePackages match package names and purls, not npm alias dependency keys (lp@npm:left-pad is matched by left-pad, not lp).
• npm 12 ignores ALLOW-REMOTE= and allow_remote= keys in .npmrc, so socket-patch appending allow-remote=all after them is correct.
• minSeverity skips patches whose per-package records carry no severity (documented). Mocks must fill vulnerabilities in by-package.
• scan -g --mode agent run inside a project records the global patch in the cwd .socket/manifest.json, and rollback -g drops it again. The manifest is cwd-scoped; CLI_CONTRACT "Global scope never touches the project's state" only covers hosted pins and the vendor ledger, and says rollback/remove -g "drop their manifest records".
• With no override, npm dedupes a root registry spec (left-pad@1.3.0) onto a transitive git copy of the same version, so the lock has a single git entry and the redirect_npm_non_registry_entry_skipped skip is correct.
• v4.0.0 agent vex omits patches with ecosystem_not_setup unless setup.manual lists the ecosystem (v4 behaviour). Set it when bisecting vex against v4.
• Hosted vex attests an omitted devDependency (npm ci --omit=dev) from its lock pin: documented ("With nothing installed … attests from that pin").
• A vendored v2 lock re-saved by npm 7/8 (npm install) loses resolved in the legacy dependencies mirror, because npm's serializer never writes it for a file: resolution. A cold-cache npm 6 npm ci then fails closed with EINTEGRITY. That's npm's behaviour; npm-compatibility.md's npm 6 + vendored v2 claim holds only until such a re-save.
• vex with a bundled (inBundle) copy refuses to attest (patched_ref_unattributable). In hosted mode the final error reads as "no references found" (exit 2) because a rejected reference keeps nothing alive (documented). Only the diagnostic is misleading.
• scan --mode agent over hosted pins keeps the pins and warns (redirectState; documented).
• npm vendored scan --prune / vendor --revert / remove keep (keptVendoredEntries, vendor_artifact_kept) an entry whose lock entry vanished after npm uninstall or a version bump. It's the deliberate drift-keep (pinned by scan_prune_reverts_unused_vendored_entry). Whether to reclaim it is an open maintainer question (Vendored vlt scan exits 1 after the patched dependency is upgraded or uninstalled, and even scan --prune exits 1 while it reverts the stale entry #541 / PR Fix vendored rescans failing on unwired ledger entries (#541) #543 scope note). The rescan exit 1 is Vendored vlt scan exits 1 after the patched dependency is upgraded or uninstalled, and even scan --prune exits 1 while it reverts the stale entry #541.

[github-actions[bot]]

[agent] 2026-09-30: npm bug-hunt run

This is the first run with a ledger. An earlier run on the same day filed #324, #325 and #326 but wrote no entry.

Tested: main f6b7fb9 (CLI 4.0.0). Latest release 4.0.0 and previous release 3.3.0, both from npm @socketsecurity/socket-patch. npm 6.14.18, 8.19.4, 10.9.7, 11.20.0 (installed, not yet exercised) and 12.1.0 on Node 22.22 (Linux). The probe added npm 10.9.4 and 12.1.0 on ubuntu, macOS and Windows.

Setup: the Socket patch API isn't reachable from the sandbox. Agent and vendored cells hand-stage .socket/manifest.json plus blobs (a marker prepended to index.js). Hosted cells use a ~60-line Python mock of the patch API: batch, by-package, the patches/package grant, patches/view and the tarball route, with the tarball gzipped with mtime 0 so the sha512 pin is stable across mock restarts. Every hosted cell ends with a fresh-checkout npm ci plus vex.

Re-triage

#324, #325 and #326 are still open, their fix PRs (#337 and #345) aren't merged yet, and main is the same commit they were filed on. I didn't re-run them.

Cells

• Agent, npm alias ("lp": "npm:left-pad@1.3.0"): fail → npm agent-mode apply never patches an npm-aliased install (lp@npm:left-pad), yet VEX attests the package not_affected #356 on npm 6, 8, 10 and 12, and on Linux, macOS and Windows. An alias-only project gets package_not_installed. A mixed project (plain + alias) patches only the plain copy, and apply --vex and vex attest not_affected. The same happens on 4.0.0 and 3.3.0. Vendored mode rewires the alias entry correctly.
• Agent, install-strategy=linked (node_modules/.store): fail → npm install-strategy=linked: transitive packages under node_modules/.store are "not installed", and scan --apply exits 0 leaving them unpatched #359 on npm 10 and 12, Linux, macOS and Windows. Transitive packages count as lockfile-only. apply exits 1, and scan --apply exits 0 with success while leaving them unpatched. vendor gets package_not_installed. Direct deps (symlinks) pass. It's the same on 4.0.0 and 3.3.0.
• Agent, workspaces (nested conflicting copies in two members): pass. Agent, bundled copies: pass (both copies patched).
• Vendored, workspace nested lock entry on npm 10 and 12: pass. Fresh npm ci, npm install, and npm install <other> -w a all keep the vendored entry.
• Hosted, npm 12: pass for a workspace member's nested entry with a fresh npm ci + vex; .npmrc auto-config with user-config all and env all; respected env root / user-config none, which warn loudly and fail closed with EALLOWREMOTE; npm install and npm install <pkg> keep the redirect on npm 10 and 12; after npm update unwires it, vex reports redirect_unwired and rollback removes the .npmrc cleanly.
• setup: pass. The postinstall + dependencies hooks re-patch nested workspace copies on npm ci (npm 10 and 12, via npx 4.0.0). A CRLF, tab-indented package.json with existing scripts round-trips byte-exact through setup / setup --remove. apply --silent on main prints nothing.

Issues

• Filed npm agent-mode apply never patches an npm-aliased install (lp@npm:left-pad), yet VEX attests the package not_affected #356: npm agent-mode apply never patches an npm-aliased install (lp@npm:left-pad), yet VEX attests the package not_affected #356 (npm aliases are never patched in agent mode, and VEX attests anyway)
• Filed npm install-strategy=linked: transitive packages under node_modules/.store are "not installed", and scan --apply exits 0 leaving them unpatched #359: npm install-strategy=linked: transitive packages under node_modules/.store are "not installed", and scan --apply exits 0 leaving them unpatched #359 (install-strategy=linked .store copies are invisible, and scan --apply exits 0)
• Commented on both with the cross-OS probe results.

False positives ruled out

• Hosted scan from a workspace member directory finds nothing: discovery is cwd-scoped, it's loud and writes nothing.
• An explicit non-all allow-remote is respected with a warning, and the install fails closed (documented).
• npm update dropping a hosted redirect is npm's own behaviour, and vex catches it.
• npm 12 doesn't install the dependencies of file: directory deps, so there's no copy to patch.
• An early hosted EINTEGRITY came from my mock: gzip mtime changed the tarball between restarts.
• 4.0.0's apply --silent token notice doesn't appear on main.

Probe runs

• https://github.com/SocketDev/socket-patch/actions/runs/36758644937 (alias + linked, 3 OS × npm 10.9.4 / 12.1.0). Its jobs are red only because the script's bash -e stopped at the expected failing apply.
• Deleting bughunt/npm/20260930-alias-linked failed (git push --delete: "remote end hung up"), so a maintainer needs to delete it.

Next

1. Windows and macOS for vendored and hosted (autocrlf checkouts, long paths, drive-letter file: specs), using the mock API inside a probe.
2. Dual-lock (shrinkwrap + package-lock) drift after npm install <pkg> on npm 11 vs 12, and patched_ref_unattributable.
3. npm 9.x and 11.20.0 cells; Node 18 and 24 with npm 12.
4. overrides to an aliased spec in hosted and vendored modes (related to npm agent-mode apply never patches an npm-aliased install (lp@npm:left-pad), yet VEX attests the package not_affected #356).
5. Concurrent apply runs, and an interrupted hosted run (.npmrc written, lock unchanged).

[github-actions[bot]]

[agent] 2026-10-01: npm bug-hunt run

Tested: main f6b7fb9 (CLI 4.0.0, unchanged since the last run). Latest release 4.0.0 and previous release 3.3.0 (npm @socketsecurity/socket-patch). npm 6.14.18, 8.19.4, 9.9.4, 10.9.7, 11.20.0 and 12.1.0 on Node 22.22 (Linux). Probes ran npm 10.9.7 and 12.1.0 on Node 24.15 on ubuntu, macOS (arm64) and Windows.

Re-triage

Main hasn't moved, so #324, #325, #326, #356 and #359 still reproduce as filed, and I didn't re-run them. #326's fix PR #345 is still open; I built its head (see below).

Cells

• Real-npm suites (e2e_redirect_npm_build, e2e_vendor_npm_build, SOCKET_PATCH_NPM_E2E_REQUIRED=1) on Linux with npm 9.9.4 and 11.20.0: pass, 14/14 each.
• Earlier probe runs found on the remote (from the ledger-less first run on 2026-09-30, never recorded): runs 36731666366 and 36733259842. Both suites pass on Windows and macOS with npm 8.19.4, 10.9.9 and 12.1.0, and on macOS with npm 6. The only red cell is Windows + npm 6, where the harness found no npm ≥ 7 to write the v2 lock (SOCKET_PATCH_NPM_E2E_LOCK_WRITER_BIN). That's a harness limitation, not a bug.
• Dual-lock (shrinkwrap + package-lock), vendored, npm 11 / 12: pass. npm install left-pad@1.3.0 on npm 12 reverts only package-lock.json, and on npm 11 only npm-shrinkwrap.json. In both cases vex refuses (no_applicable_patches), both with and without the manifest. A vendor re-run rewires both locks, and a fresh npm ci gets the patched bytes.
• overrides to an aliased spec ("is-number": "npm:kind-of@6.0.3"), vendored, npm 10/11/12: pass (npm ci and npm install keep the entry and install the patched bytes; vex is not_affected). Agent mode on that shape is npm agent-mode apply never patches an npm-aliased install (lp@npm:left-pad), yet VEX attests the package not_affected #356's root cause.
• Scoped alias ("@my/lp": "npm:left-pad@1.3.0"), vendored, npm 11: pass, including a byte-exact vendor --revert.
• Nested copy in a lockfileVersion 2 lock, vendored, then npm ci with npm 6, 8 and 12: pass. The legacy dependencies mirror is rewired too.
• Local file: tarball dep, vendored, npm 8/10/11/12: fail. That's npm hosted and vendored modes rewire git-sourced lock entries, so npm ci silently installs the unpatched git bytes while scan and VEX report success #326, so I added a comment instead of filing. PR Fix npm rewiring git/URL/file lock entries (#326) #345's head refuses it with vendor_lock_entry_not_rewritable.
• Global (apply -g) with npm_config_prefix / --global-prefix, npm 6/9/11/12: pass.
• node_modules as a symlink to a directory outside the project: apply and rollback pass.
• Concurrent apply ×6: exactly one wins and the rest get lock_held (documented fail-fast default). A stale apply.lock and a SIGKILLed holder don't block the next run.
• setup on npm 11 with a workspace: pass (both root and member hooks; the root copy is re-patched on npm ci).
• Probe 20261001-crlf-paths (run 36796395924), 3 OS × npm 10/12, under a space + unicode path: a vendored project committed with LF and cloned with core.autocrlf=true passes npm ci (patched) and vex (not_affected), and a vendor re-run is a no-op. vendor --revert drops the CRLF (npm lock rewrites drop CRLF (and hosted drops tab indent), so rollback and vendor --revert are not byte-exact; BOM locks are refused #324). Agent mode with a CRLF manifest: apply and rollback pass. A deep path (~270 characters) passes on Linux and macOS; on Windows, npm itself can't run there (Win32 cwd limit).
• Platform-skipped optional dependency: fail → npm apply exits 1 when every patch targets a platform-skipped optional dependency (fsevents, @esbuild/*), so the setup hook fails npm ci and npm install on other OSes #403. When every manifest patch targets an optional package the host doesn't install (fsevents, @esbuild/*), apply exits 1, so the setup hook fails npm ci and npm install. It reproduces on Linux with npm 8/10/11/12 and in probe 20261001-optional-dep (run 36796693378) on all 3 OSes × npm 10/12. 4.0.0 and 3.3.0 do the same. With one installed patch alongside, it's only a warning and exits 0.

Issues

• Filed npm apply exits 1 when every patch targets a platform-skipped optional dependency (fsevents, @esbuild/*), so the setup hook fails npm ci and npm install on other OSes #403: npm apply exits 1 when every patch targets a platform-skipped optional dependency (fsevents, @esbuild/*), so the setup hook fails npm ci and npm install on other OSes #403
• Commented on npm hosted and vendored modes rewire git-sourced lock entries, so npm ci silently installs the unpatched git bytes while scan and VEX report success #326 (file: tarball variant, and PR Fix npm rewiring git/URL/file lock entries (#326) #345 verified): npm hosted and vendored modes rewire git-sourced lock entries, so npm ci silently installs the unpatched git bytes while scan and VEX report success #326 (comment)

False positives ruled out

• apply skipping an unwired vendored package as "managed by socket-patch vendor" (exit 0) after the lock is reverted is by design: apply never takes ownership back from vendor, and vex refuses.
• rollback removing the manifest entries and GCing their blobs is documented (README command table).
• Agent-mode vex exits 1 with ecosystem_not_setup when there's no setup hook or setup.manual. That's documented.
• The VEX product @id is the raw origin URL for a non-GitHub/GitLab/Bitbucket remote, which is documented (vex --help).
• npm ≥ 11 redacts UUID-shaped path segments in npm root -g output (/tmp/***/…), so apply -g misses a global prefix whose path contains a UUID (loud: package_not_installed, exit 1). That's npm's output redaction, and rare; not filed. A workaround exists (--global-prefix).
• The Windows deep-path failure comes from npm/node themselves, not socket-patch.

Probe branches

• bughunt/npm/20261001-crlf-paths, bughunt/npm/20261001-optional-dep. git push --delete prints "Everything up-to-date" through the proxy and deletes nothing, for these and for the three 2026-09-30 branches (20260930-alias-linked, 20260930-win-mac-e2e, 20260930-win-old-npm). A maintainer needs to delete all five.

Next

1. Hosted mode on macOS and Windows with the .npmrc allow-remote auto-config (the suites pass; probe user-config none and env overrides there).
2. npm ci --omit=optional / --omit=dev against a manifest that patches an omitted package (likely the same root cause as npm apply exits 1 when every patch targets a platform-skipped optional dependency (fsevents, @esbuild/*), so the setup hook fails npm ci and npm install on other OSes #403; check vendored and hosted too).
3. Node 18 with npm 9/10, and npm 12 on Node 26.
4. npm install-links=true file: directory deps (packed copies) in agent and vendored modes.
5. Interrupted hosted run (.npmrc written, lock unchanged), using the wiremock harness.

[github-actions[bot]]

[agent] 2026-10-01: maintainer note: test global (-g) mode for hosted patches

This is a maintainer request, not a run report. Add it to the top of the backlog and keep it there until the cells below are covered.

Ask: make sure we correctly scan global installs when -g / --global is passed, on every major npm version and on Linux, macOS and Windows.

Where npm puts global installs: npm install -g; discovery via npm root -g. Cover the default prefix, a user prefix (npm config set prefix), nvm / volta / fnm / Homebrew node, and Windows %APPDATA%\npm. Known: npm ≥ 11 redacts UUID path segments in npm root -g, so --global-prefix is needed there.

What to check (prove each with a real global install, not by reading source):

1. socket-patch scan -g (no --mode) is report-only. It must find every globally installed npm package that has a hosted patch: none missing, no project packages leaking in, correct versions. Also check --json.
2. scan -g run from inside a npm project versus outside one: -g must scan only the global location, and a scan without -g must never touch it.
3. scan -g --mode hosted and scan --global-prefix <dir> --mode hosted must refuse loudly, as designed ("global installs have no project lockfile to redirect"). They must exit non-zero and write nothing.
4. get -g defaults to agent mode. Check scan -g --apply, apply -g, rollback -g and vex -g: the globally installed copy is actually patched (run the installed tool or import it), rollback restores it byte for byte, and vex only attests what's applied.
5. --global-prefix <dir> and SOCKET_GLOBAL=1 behave the same as -g. That covers custom prefixes, version managers, paths with spaces or unicode, and a non-root user's prefix.
6. A global directory you can't write to (root-owned prefix, Windows Program Files) must fail loudly with a clear error, never exit 0 unpatched.

Add OS × npm version cells for -g (scan report / apply / rollback) to the coverage matrix, and use probe branches for macOS and Windows.

[github-actions[bot]]

[agent] 2026-10-01: npm bug-hunt run

Tested: main 2463257 (v5 consolidation, #277: hosted is now the default, setup is removed, and hosted rollback re-resolves upstream registry entries). The binary still reports 4.0.0. The latest release is v4.0.0 (previous v3.3.0); v4.0.0 was installed from npm for bisecting. On Linux: npm 6.14.18, 8.19.4, 10.9.7, 11.20.0 and 12.1.0 on Node 22.22. The probes ran npm 10.9.7 and 12.1.0 on Node 24.15 on ubuntu-latest, macos-latest, windows-latest and windows-2022.

Setup: a Python mock of the patch API (batch, by-package, patches/package, view, blob and /patch/npm/<token>/<uuid>/<leaf>.tgz) with --patch-server-url pointed at it, because hosted pins are only recognized on the patch-server origin. Sandbox-only workaround: the Rust client doesn't trust the egress proxy CA, so hosted rollback's registry lookups go through a mock passthrough (SOCKET_NPM_REGISTRY=http://127.0.0.1:8765/reg). The CI probes used the real registry.

Re-triage

• npm agent-mode apply never patches an npm-aliased install (lp@npm:left-pad), yet VEX attests the package not_affected #356 (agent mode, npm alias): still reproduces on v5. apply returns package_not_installed. Hosted and vendored handle the alias. npm agent-mode apply never patches an npm-aliased install (lp@npm:left-pad), yet VEX attests the package not_affected #356 (comment)
• npm apply exits 1 when every patch targets a platform-skipped optional dependency (fsevents, @esbuild/*), so the setup hook fails npm ci and npm install on other OSes #403 (platform-skipped optional dependency): still reproduces (apply exits 1). setup is gone, but v5 docs tell agent projects to run apply in CI. npm apply exits 1 when every patch targets a platform-skipped optional dependency (fsevents, @esbuild/*), so the setup hook fails npm ci and npm install on other OSes #403 (comment)

Cells

• Hosted full cycle (scan → fresh npm ci → vex → rollback byte-exact): pass on Linux for: plain packages on npm 10; aliases on npm 10 and on npm 8 (v2 lock, packages half only, see npm v2 lock: aliased packages stay on the registry in the legacy dependencies mirror (hosted silently, vendored with a warning), so npm 6 installs unpatched bytes while VEX attests not_affected #432); scoped packages on npm 11; nested copies on npm 8 and 10; duplicate nested copies in workspace members on npm 11; a workspace with an alias and a nested member entry on npm 12; dual-lock on npm 12; lockfileVersion 1 on npm 6 (npm 6 does install the patched bytes from a hosted v1 lock here, contrary to the "fails closed EINTEGRITY" row in npm-compatibility.md; that's better than documented, so not filed). Probe: it passes on all 6 OS × npm cells (aliases + nested, under a space + unicode path), and .npmrc is deleted on rollback.
• Hosted re-run idempotency: pass (rollout already: 3, lock unchanged). Lockfile-only checkout and stale tree: pass (uses the lock version). --dry-run writes nothing.
• Hosted → vendored takeover, then full rollback: pass on npm 12 with workspaces (git diff empty).
• Dual-lock drift after npm install <pkg> on npm 11 and 12: pass (rollback restores both locks).
• Path-scoped rollback, remove <uuid>, list: pass. remove --preserve-state is missing its documented note: fail → remove --preserve-state on a manifest-less hosted npm project silently restores the pin without the documented hosted_state_not_preservable note #433.
• omit-lockfile-registry-resolved=true: cycle passes, but rollback adds resolved back (see known non-bugs).
• Nested independent project (tools/sub, not a workspace): a bare scan warns redirect_npm_entry_not_found and wires only the root. scan . tools/sub wires both. Root rollback / vex don't see tools/sub; --cwd tools/sub does. Per-project model, loud; not filed.
• Vendored: repair re-downloads a deleted or tampered artifact (pass). vendored_tree_out_of_sync warns only (documented).
• npm alias in a lockfileVersion 2 legacy mirror: fail → npm v2 lock: aliased packages stay on the registry in the legacy dependencies mirror (hosted silently, vendored with a warning), so npm 6 installs unpatched bytes while VEX attests not_affected #432. Hosted (silently) and vendored (with a warning) leave dependencies.<alias> on the registry, so npm 6 installs unpatched bytes while lockfile-only vex returns not_affected. 4.0.0 behaves the same. A v1 alias lock in hosted mode writes nothing (redirect_npm_entry_not_found, exit 0).
• Global mode (maintainer checklist): Linux sandbox npm 10/12, ubuntu and macOS probes: pass for scan -g report-only (only global packages, no project leak, no writes; -g without -e also scans cargo/pypi/gem global stores by design), --global-prefix and SOCKET_GLOBAL=1 parity, scan -g --mode hosted refusing with exit 2, get -g / scan -g --mode agent patching the real global copy, vex -g --product attesting only applied patches (it refuses after a reinstall), and rollback -g byte-exact. Windows: fail → On Windows, scan -g / get -g / vex -g find no global npm packages because npm root -g is spawned as bare npm, which never resolves to npm.cmd #434 (bare npm spawn; scan -g finds nothing and exits 0; --global-prefix works). Not covered: unwritable prefix (sandbox runs as root), nvm/volta/fnm.

Issues

• Filed npm v2 lock: aliased packages stay on the registry in the legacy dependencies mirror (hosted silently, vendored with a warning), so npm 6 installs unpatched bytes while VEX attests not_affected #432: npm v2 lock: aliased packages stay on the registry in the legacy dependencies mirror (hosted silently, vendored with a warning), so npm 6 installs unpatched bytes while VEX attests not_affected #432
• Filed remove --preserve-state on a manifest-less hosted npm project silently restores the pin without the documented hosted_state_not_preservable note #433: remove --preserve-state on a manifest-less hosted npm project silently restores the pin without the documented hosted_state_not_preservable note #433
• Filed On Windows, scan -g / get -g / vex -g find no global npm packages because npm root -g is spawned as bare npm, which never resolves to npm.cmd #434: On Windows, scan -g / get -g / vex -g find no global npm packages because npm root -g is spawned as bare npm, which never resolves to npm.cmd #434
• Commented on npm agent-mode apply never patches an npm-aliased install (lp@npm:left-pad), yet VEX attests the package not_affected #356 and npm apply exits 1 when every patch targets a platform-skipped optional dependency (fsevents, @esbuild/*), so the setup hook fails npm ci and npm install on other OSes #403 (above).

False positives ruled out

• Hosted rollback / vex "Manifest not found" on mock URLs: hosted pins are only recognized on patch.socket.dev or the --patch-server-url origin (documented). A mock artifact.
• Hosted rollback registry error sending request: the sandbox proxy CA. A sandbox artifact.
• vex -g needs --product outside a project. Reasonable and loud.
• Rollback re-adding resolved under omit-lockfile-registry-resolved=true: hosted keeps no ledger, so the restore can't know the field was absent, and npm drops it again on the next install. Harmless.
• A failed hosted lock write (immutable package-lock.json) leaves allow-remote=all in .npmrc. Exit 1, and it's the documented mid-flush I/O residual.
• rollback ./packages/a matches nothing when a's dependency is hoisted to the root (path targets select installed copies; documented).

Probe branches

bughunt/npm/20261001-v5-hosted-global (runs 36824736862 and 36825128447; the first run's npm 12 cells failed because npm 12 needs Node ≥ 24.15) and bughunt/npm/20261001-win-global (run 36826141655). git push --delete prints "Everything up-to-date" through the proxy and deletes nothing. A maintainer needs to delete these two plus the five older ones.

Next

1. The global-mode leftovers: unwritable prefix (needs a non-root runner or Windows Program Files), nvm/volta/fnm/Homebrew prefixes on macOS, and %APPDATA%\npm after On Windows, scan -g / get -g / vex -g find no global npm packages because npm root -g is spawned as bare npm, which never resolves to npm.cmd #434 is fixed.
2. Hosted mode with a custom .npmrc registry= mirror: does rollback restore to npmjs.org instead of the mirror (documented "default upstream"), and does npm ci then work?
3. npm ci --omit=optional / --omit=dev against hosted and vendored entries plus vex.
4. v5 socket.yml policy (minSeverity, maxNewPatches) and --package filters on npm workspaces.
5. Node 18 with npm 9/10, and npm 12 on Node 26.

[github-actions[bot]]

[agent] 2026-10-01: handover from the Yarn Berry (2+) bug-hunt routine (#305)

This one isn't Berry-specific, so it's yours to triage if you want it. On main 2463257, a report-only socket-patch scan -g (no --mode) that finds patches prints:

To apply these patches in place, run:
  socket-patch scan --mode agent [PATHS]

The hint leaves out -g (crates/socket-patch-cli/src/commands/scan/render.rs:253 report_only_hint() takes no global flag). Following it literally scans and patches the cwd project instead of the global install, or finds nothing when run outside a project. Repro: NPM_CONFIG_PREFIX=/tmp/g npm i -g <pkg-with-a-patch>; socket-patch scan -g. Low severity (UX). Not filed by yarn-berry.

[github-actions[bot]]

[agent] 2026-10-01: handover from the vlt bug-hunt routine (ledger #307)

While covering the maintainer's -g checklist (item 6, an unwritable global directory), I found something in plain npm global mode. vlt has no global install, so it belongs to you. Not filed.

Symptom: after a failed agent-mode get -g, re-running the same get -g exits 0 with status: success and never retries the apply. The global copy stays unpatched.

• Run 1 (fresh, no .socket/): socket-patch get pkg:npm/left-pad@1.3.0 -g --yes → rc 1, Error: Failed to patch …: Permission denied (os error 13). It still writes .socket/manifest.json with the record ("Patches saved … Added: 1").
• Run 2 and later: [skip] pkg:npm/left-pad@1.3.0 (already in manifest), No changes to ./.socket/manifest.json, rc 0. --json gives {"status": "success"}. The global index.js is still the upstream bytes.
• Controls on the same state: apply -g → rc 1 apply_failed (correct), and scan -g --mode agent → rc 1 partial_failure (correct). Only get swallows it.

Repro: main 2463257, Linux sandbox, a non-root user. NPM_CONFIG_PREFIX=<dir>, npm install -g left-pad@1.3.0 as root, then chmod -R go-w <dir>. Run get twice as the user, with a mock patch API (the mock is in the vlt probe workflow, run 36834317384). It also reproduces on ubuntu-latest with a sudo chown -R root prefix: run 36835560958, RO[1]/RO[2] get -g rc=0 status=success global=pristine, after a failed scan -g --mode agent.

Related: #424 covers the first run's --json dropping the failure (Maven). This is the follow-up: the second run reports success. It probably isn't -g-specific (any agent get whose apply failed once), but I only verified the global npm case.

---

Generated by Claude Code

[github-actions[bot]]

[agent] 2026-10-01: npm bug-hunt run

Tested: main 2463257 (v5 consolidation, #277; unchanged since the last run). Latest release v4.0.0, installed from npm for bisecting. Linux sandbox: npm 8.19.4, 10.9.4 and 11.20.0 on Node 22.22, plus npm 12.1.0 on Node 24.15 (downloaded from nodejs.org). The patch API was the same Python mock as the 20261001T065328Z run, with --patch-server-url and SOCKET_NPM_REGISTRY pointed at it. I pushed no probe branches.

Handovers triaged

• From yarn-berry: the report-only scan -g hint has no -g. Confirmed with npm, and also with --global-prefix. Running the hint as printed outside a project gives No packages found and exit 0, and the global copy stays unpatched. v4.0.0 applied directly, so the bad hint is new in v5 prerelease: scan → vex → vendor workflow, hosted by default #277. Filed A report-only scan -g tells you to run socket-patch scan --mode agent [PATHS] without -g, so following the hint scans the cwd project instead of the global install #464.
• From vlt: re-running get after a failed apply exits 0. Confirmed in a project too, not only under -g: a read-only node_modules as non-root, and also the common case of npm ci reinstalling pristine bytes followed by get <purl> (status: success, applied: 0, skipped). v4.0.0 behaves the same. Duplicate of scan --sync / --mode agent never re-applies an already-recorded patch, so after a fresh Hatch env (or any reinstall) it exits 0 with the package unpatched #454 (Hatch), whose root cause, get.rs:2438 downloaded > 0, covers get too; fix PR Fix agent scan/get skipping apply for recorded patches (#454) #456 is open. Not filed. Bare scan --mode agent at least prints "run socket-patch apply to re-apply"; get prints no hint.

Re-triage

• npm lock rewrites drop CRLF (and hosted drops tab indent), so rollback and vendor --revert are not byte-exact; BOM locks are refused #324 (CRLF lock): still reproduces with v5 hosted. 0 of 22 lines keep CRLF after scan, and rollback isn't byte-exact. npm lock rewrites drop CRLF (and hosted drops tab indent), so rollback and vendor --revert are not byte-exact; BOM locks are refused #324 (comment)
• npm VEX attests not_affected while a bundled (inBundle) copy of the same package@version stays unpatched #325 (bundled copy): still reproduces with v5 hosted. The in-run --vex and the pre-install vex attest not_affected, and post-install vex refuses. npm VEX attests not_affected while a bundled (inBundle) copy of the same package@version stays unpatched #325 (comment)

Cells

• Hosted + .npmrc registry= mirror (local rewriting mirror), npm 10 and npm 12: pass. Scan, fresh npm ci (patched), rollback, then npm ci all work. Rollback restores resolved to registry.npmjs.org rather than the mirror. That's documented ("default upstream registry entry", SOCKET_NPM_REGISTRY), and npm's replace-registry-host keeps npm ci working. allow-remote=all stays, with the documented npm_allow_remote_left warning.
• .npmrc variants for allow-remote: no trailing newline, CRLF, BOM, allow-remote = all (spaces), quoted "all", ALLOW-REMOTE=…, allow_remote=…, a trailing [section], and explicit none: pass. npm 12 ignores the uppercase and underscore keys (npm config get checked), so appending is correct. Spaces and quotes count as already set. The CRLF line ending is preserved. On npm 12, a fresh npm ci passes for the mirror, spaces and CRLF variants.
• overrides (flat, alias npm: and nested) × npm 8.19.4 / 10 / 11.20.0, hosted: pass. Fresh npm ci gets the patched bytes, and a later npm install keeps the pin.
• install-strategy=linked|nested|shallow on npm 11, hosted with an alias: pass for the cycle, vex and byte-exact rollback.
• v5 policy on an npm workspace with an alias: pass for --package left-pad, the purl forms, --max-new-patches 1 (rolls out over runs), 0, ignorePackages, and minSeverity critical/high/low. An alias key (--package lp) matches nothing, because specs match package names, not dependency keys (see known non-bugs).

Issues

• Filed A report-only scan -g tells you to run socket-patch scan --mode agent [PATHS] without -g, so following the hint scans the cwd project instead of the global install #464: A report-only scan -g tells you to run socket-patch scan --mode agent [PATHS] without -g, so following the hint scans the cwd project instead of the global install #464
• Commented on npm lock rewrites drop CRLF (and hosted drops tab indent), so rollback and vendor --revert are not byte-exact; BOM locks are refused #324 and npm VEX attests not_affected while a bundled (inBundle) copy of the same package@version stays unpatched #325 (above).

False positives ruled out

• minSeverity: high skipped everything at first. My mock's by-package records had empty vulnerabilities, which the documented behaviour treats as unknown severity. A mock artifact.
• socket_yml_invalid: my socket.yml had no version: 2. Documented.
• The vlt get rerun: a duplicate of scan --sync / --mode agent never re-applies an already-recorded patch, so after a fresh Hatch env (or any reinstall) it exits 0 with the package unpatched #454.

Next

1. Global-mode leftovers: an unwritable prefix on Windows Program Files; nvm, volta, fnm and Homebrew prefixes on macOS; %APPDATA%\npm after On Windows, scan -g / get -g / vex -g find no global npm packages because npm root -g is spawned as bare npm, which never resolves to npm.cmd #434.
2. Node 18 with npm 9/10, and npm 12 on Node 26.
3. npm ci --omit=optional / --omit=dev with hosted and vendored entries plus vex.
4. Re-verify npm hosted and vendored modes rewire git-sourced lock entries, so npm ci silently installs the unpatched git bytes while scan and VEX report success #326 (git deps) and npm install-strategy=linked: transitive packages under node_modules/.store are "not installed", and scan --apply exits 0 leaving them unpatched #359 (linked transitive, agent mode) on v5.
5. Once Fix agent scan/get skipping apply for recorded patches (#454) #456 lands, re-check the npm get rerun case and close the loop with vlt.

[github-actions[bot]]

[agent] 2026-10-01: npm bug-hunt run

Tested: main 61cfb9b. Since the last run, main gained #345 (git/URL/file entries, #326), #357 (JSON layout, #324), #337 (bundled VEX, #325), #446 (-g scope), #456 (agent rerun, #454) and #365 (linked .store, #359). The binary still reports 4.0.0. The latest release is v4.0.0, installed from npm for bisecting. Linux sandbox: npm 8.19.4, 10.9.4 and 11.21.0 on Node 22.22, and npm 12.2.0 on Node 24.21 (12.2.0 and 11.21.0 are new releases). The patch API was a local Python mock, with --patch-server-url and SOCKET_NPM_REGISTRY pointed at it. I pushed no probe branches; nothing found this run is OS-specific.

Re-triage

• npm agent-mode apply never patches an npm-aliased install (lp@npm:left-pad), yet VEX attests the package not_affected #356 (agent mode, npm alias): still reproduces on 61cfb9b (package_not_installed). npm agent-mode apply never patches an npm-aliased install (lp@npm:left-pad), yet VEX attests the package not_affected #356 (comment)
• npm apply exits 1 when every patch targets a platform-skipped optional dependency (fsevents, @esbuild/*), so the setup hook fails npm ci and npm install on other OSes #403 (platform-skipped optional dependency): still reproduces. apply exits 1 when fsevents is the only entry, and exits 0 when an installed patch is also in the manifest. npm apply exits 1 when every patch targets a platform-skipped optional dependency (fsevents, @esbuild/*), so the setup hook fails npm ci and npm install on other OSes #403 (comment)
• npm VEX attests not_affected while a bundled (inBundle) copy of the same package@version stays unpatched #325 (bundled copy), closed by Fix npm VEX attesting packages with an unpatched bundled copy (#325) #337: reopened. Hosted in-run scan --vex still attests not_affected while its own patched_ref_unattributable warning says "not attested". Hosted post-install vex and vendored in-run are fixed. npm VEX attests not_affected while a bundled (inBundle) copy of the same package@version stays unpatched #325 (comment)

Cells

• Fix npm rewiring git/URL/file lock entries (#326) #345 regression with overrides: fail → npm hosted and vendored modes refuse a registry-installed package when its dependent's git spec is replaced by an overrides entry (regression from #345) #490. A transitive dependency spec github:… overridden to registry 1.3.0 installs from the registry, yet hosted skips it (redirect_npm_non_registry_entry_skipped, exit 0, unpatched), vendored fails (vendor_lock_entry_not_rewritable), and vex refuses even a correctly redirected tree. npm 8, 10, 11 and 12 all reproduce. v4.0.0 redirects it and npm ci installs the patched bytes.
• Fix JSON writers dropping CRLF/BOM/indent (#324, #351) #357 lock layout, full cycle (scan → npm ci patched → vex → rollback / vendor --revert byte-exact → npm ci): pass for CRLF, BOM+CRLF, tab indent and no trailing newline. Hosted and vendored on npm 10, and BOM+CRLF and tab on npm 12.2.0. 8 changed lines, layout kept.
• Fix npm crawler missing relocated dependency stores (#359, #362) #365 install-strategy=linked with a scoped transitive dep (@sindresorhus/is under got), agent mode on npm 11.21: pass. The .store copy gets patched, node resolves the patched file, vex passes, rollback is byte-exact.
• Bundled copy (npm@10.9.4 bundling ansi-regex@5.0.1 + root strip-ansi): agent mode patches both copies and vex attests (pass). Hosted in-run --vex is the npm VEX attests not_affected while a bundled (inBundle) copy of the same package@version stays unpatched #325 failure above.
• git dep without an override: npm 10 dedupes the root left-pad@1.3.0 spec onto the git copy, so the skip is correct (pass).
• scan -g --mode agent from inside a project: it patches the global copy and writes the record into the cwd .socket/manifest.json. rollback -g restores the global copy and drops that record. This matches CLI_CONTRACT ("drop their manifest records"). Not filed; see known non-bugs.

Issues

• Filed npm hosted and vendored modes refuse a registry-installed package when its dependent's git spec is replaced by an overrides entry (regression from #345) #490: npm hosted and vendored modes refuse a registry-installed package when its dependent's git spec is replaced by an overrides entry (regression from #345) #490
• Reopened npm VEX attests not_affected while a bundled (inBundle) copy of the same package@version stays unpatched #325 with a comment. Commented on npm agent-mode apply never patches an npm-aliased install (lp@npm:left-pad), yet VEX attests the package not_affected #356 and npm apply exits 1 when every patch targets a platform-skipped optional dependency (fsevents, @esbuild/*), so the setup hook fails npm ci and npm install on other OSes #403.

False positives ruled out

• vex -o is --org; the output flag is -O. My script error.
• The git left-pad "registry" root entry: npm really did install the git copy for both edges, so the skip is correct.

Next

1. After npm hosted and vendored modes refuse a registry-installed package when its dependent's git spec is replaced by an overrides entry (regression from #345) #490 is fixed: overrides that use $ref, and nested override objects over a git or URL transitive dependency.
2. Hosted in-run --vex against the other contested shapes (dual-lock with a git copy in shrinkwrap only, workspace-member bundles).
3. Global-mode leftovers: an unwritable prefix on Windows Program Files; nvm, volta, fnm and Homebrew on macOS; %APPDATA%\npm after On Windows, scan -g / get -g / vex -g find no global npm packages because npm root -g is spawned as bare npm, which never resolves to npm.cmd #434.
4. Node 18 with npm 9/10, and npm 12 on Node 26.
5. npm ci --omit=optional / --omit=dev with hosted and vendored entries plus vex.

[github-actions[bot]]

[agent] 2026-10-01: handover from the Deno bug-hunt routine (ledger #308): agent-mode vex attests not_affected while other nested copies of the same name@version are unpatched

Found while testing Deno's hoisted linker. The root cause is generic npm-family, and the realistic trigger is plain npm, so this is yours to file. Nothing was filed from Deno. I searched for duplicates (#325, #405, #435, #471 are bundled / hosted / isolated / global variants) and found none covering agent mode.

Defect. In agent mode vex hashes only the first installed copy of each PURL: crates/socket-patch-cli/src/commands/vex.rs:556 let package_paths = collapse_to_first(copies.clone());. Every other copy is ignored, while hosted-basis PURLs check every copy (vex_consumed). CLI_CONTRACT's verification table says agent evidence is "the installed tree". When the first copy is patched and another copy of the same name@version isn't, vex emits not_affected for a package whose unpatched copy is still loaded at runtime. The verdict depends on crawl order: revert the first copy instead and vex correctly says not_applied.

Realistic trigger (real npm 10.9.4, main 61cfb9b, Linux, reproduced 2/2). apply patches every copy present, then a later npm install of new dependents extracts fresh, unpatched nested copies and leaves the old patched one alone:

mkdir npmdup && cd npmdup && echo '{"name":"npmdup","version":"1.0.0"}' > package.json
npm install kind-of@6.0.3 is-number@3.0.0          # nests kind-of@3.2.2 under is-number
# offline manifest + blobs patching package/index.js of pkg:npm/kind-of@3.2.2 (any free patch works)
socket-patch apply --offline                         # applied 1
npm install is-accessor-descriptor@0.1.6             # adds node_modules/is-accessor-descriptor/node_modules/kind-of@3.2.2 (unpatched)
socket-patch vex --offline -O v.json                 # exit 0, 1 statement: not_affected pkg:npm/kind-of@3.2.2

Copies afterwards: is-number/node_modules/kind-of patched, is-accessor-descriptor/node_modules/kind-of unpatched. A re-run of apply does patch the new copies (applied: 2, skipped: 1), so apply is fine; only vex is wrong.

Deno too: nodeModulesLinker: "hoisted" (2.9.7) with kind-of@6.0.3 + is-number@3.0.0 + is-accessor-descriptor@0.1.6 gives two nested kind-of@3.2.2 copies. Reverting the is-accessor-descriptor copy → vex not_affected. Reverting the is-number copy → not_applied. Same crawl-order dependence. It's likely the same for yarn classic, bun hoisted and pnpm (multiple .pnpm peer variants of one version).

Expected: agent vex attests a PURL only when every installed copy the crawler finds verifies (the hosted path already does this), otherwise it omits it as not_applied / hash_mismatch.

[github-actions[bot]]

[agent] 2026-10-02: npm bug-hunt run

Tested: main 61cfb9b, unchanged since the last run. The binary reports 4.0.0. The latest release is v4.0.0, installed from npm for bisecting. Linux sandbox: npm 8.19.4, 10.9.4 and 12.2.0 on Node 22.22. Patches were hand-staged in .socket/ (offline agent mode). I pushed no probe branches; the logic tested isn't OS-specific. Main hadn't moved, so I skipped re-triage.

Handover triaged

• From Deno (20261001T200256Z): agent vex checks only the first copy of a PURL. Confirmed with plain npm. apply patches is-number/node_modules/kind-of@3.2.2. Then npm install is-accessor-descriptor@0.1.6 adds an unpatched nested kind-of@3.2.2, and vex attests not_affected with exit 0. Swap which copy is patched and it says not_applied instead (crawl-order dependence). Reproduces on npm 8.19.4, 10.9.4 (2/2) and 12.2.0. v4.0.0 behaves the same (with setup.manual), so it isn't a regression. Filed Agent-mode npm vex hashes only the first installed copy of a package, so it attests not_affected while another nested copy of the same name@version is unpatched #516.

Cells

• Agent vex with duplicate nested copies: fail Agent-mode npm vex hashes only the first installed copy of a package, so it attests not_affected while another nested copy of the same name@version is unpatched #516 on npm 8, 10 and 12 (Linux).
• npm ci --omit=dev with an agent manifest: apply exits 1 when every patch targets the omitted devDependency, and exits 0 when a prod patch is also present. Same root cause as npm apply exits 1 when every patch targets a platform-skipped optional dependency (fsevents, @esbuild/*), so the setup hook fails npm ci and npm install on other OSes #403 ("any lockfile-only entry"), so I commented there instead of filing. vex correctly omits the devDependency (package_not_found) and attests the installed one (pass).

Issues

• Filed Agent-mode npm vex hashes only the first installed copy of a package, so it attests not_affected while another nested copy of the same name@version is unpatched #516: Agent-mode npm vex hashes only the first installed copy of a package, so it attests not_affected while another nested copy of the same name@version is unpatched #516
• Commented on npm apply exits 1 when every patch targets a platform-skipped optional dependency (fsevents, @esbuild/*), so the setup hook fails npm ci and npm install on other OSes #403 (new --omit=dev trigger): npm apply exits 1 when every patch targets a platform-skipped optional dependency (fsevents, @esbuild/*), so the setup hook fails npm ci and npm install on other OSes #403 (comment)

False positives ruled out

• On v4.0.0, vex first omitted the patch with ecosystem_not_setup. That's documented v4 behaviour; with setup.manual: ["npm"] it shows the same false not_affected.

Next

1. Hosted and vendored npm ci --omit=dev / --omit=optional plus vex. This needs the local patch-API mock again.
2. Once npm hosted and vendored modes refuse a registry-installed package when its dependent's git spec is replaced by an overrides entry (regression from #345) #490 is fixed: overrides with $ref or nested objects over git / URL / file: transitive deps.
3. Hosted in-run --vex against other contested shapes (npm VEX attests not_affected while a bundled (inBundle) copy of the same package@version stays unpatched #325): a git copy only in the shrinkwrap, bundles inside workspace members.
4. Agent-mode npm vex hashes only the first installed copy of a package, so it attests not_affected while another nested copy of the same name@version is unpatched #516 follow-up: agent vex with duplicate copies across workspace members and under install-strategy=linked .store peer variants.
5. Node 18 with npm 9/10, and npm 12 on Node 26. Global-mode leftovers (see the backlog).

[github-actions[bot]]

[agent] 2026-10-02: npm bug-hunt run

Tested: main 61cfb9b (unchanged since the last run; the binary reports 4.0.0), latest release v4.0.0. Linux sandbox: npm 6.14.18, 7.0.15, 7.24.2, 8.19.4, 9.9.4, 10.9.4 and 11.21.0 on Node 22.22; npm 12.2.0 on Node 24.21 and on Node 26.10. The patch API was the local Python mock (from the earlier probe branches), with --patch-server-url and SOCKET_NPM_REGISTRY pointed at it. Every cell ends with a fresh-checkout npm ci and vex. Main hadn't moved and no issue had new activity, so I skipped re-triage.

Probe

bughunt/npm/20261002-v5-agent-vendored-winmac, run https://github.com/SocketDev/socket-patch/actions/runs/36973087643. ubuntu-latest, macos-latest, windows-latest and windows-2022 × npm 10.9.7 / 12.2.0 on Node 24.15, in paths with spaces and ü. All 8 jobs pass every cell:

• agent scan --mode agent under install-strategy=linked patches all 4 .store copies, then vex and rollback (npm install-strategy=linked: transitive packages under node_modules/.store are "not installed", and scan --apply exits 0 leaving them unpatched #359's fix confirmed on macOS and Windows);
• the vendored cycle, including npm ci --omit=dev, vex, and a byte-exact vendor --revert with no artifacts left behind;
• the hosted linked cycle with vex.

The branch delete failed through the proxy again ("remote end hung up"), so it joins the stale-branch list.

Cells (Linux unless noted)

• Hosted npm ci --omit=dev + vex (npm 10): pass. The omitted devDependency is attested from its lock pin, which CLI_CONTRACT documents ("With nothing installed … attests from that pin").
• Vendored cycle with --omit=dev, nested copy, revert: pass on npm 7.0.15, 7.24.2, 8.19.4, 9.9.4, 10.9.4, 11.21.0, 12.2.0 (Node 24 and 26). On npm 6 with a v1 lock it refuses loudly with vendor_lockfile_version_unsupported, which is documented.
• Hosted cycle (alias, nested, devDependency, byte-exact rollback): pass on npm 7.0.15, 7.24.2, 9.9.4, and 12.2.0 on Node 26.
• Workspaces (a member's nested copy, root + member deps), vendored and hosted: pass on npm 7.0.15, 7.24.2, 8.19.4, 10, 12.
• npm-shrinkwrap.json as the only lock, hosted: pass on npm 6 (v1) and npm 8 (v2).
• A file: tarball dependency that ships its own npm-shrinkwrap.json (its nested copy pinned by it), hosted, with npm ci and npm install: pass.
• Mixed-case legacy name (JSONStream), hosted cycle: pass.
• npm 12 hosted with install-strategy=linked: pass. Rollback leaves allow-remote=all in a mixed .npmrc (documented npm_allow_remote_left).
• allow-remote=all already set in the env var or ~/.npmrc when scanning: the project .npmrc is still written, so teammates' npm 12 npm ci works. Pass.
• Takeovers vendored↔hosted (npm 7.24.2, 8.19.4, 12) and agent↔hosted/vendored (npm 10): pass, byte-exact undo. hosted→agent keeps the pins with a loud warning plus redirectState (documented).
• Rescan idempotency (vendored and hosted, npm 8 and 12): pass, nothing rewritten.
• remove <purl> for a member's nested copy in a workspace, hosted and vendored on npm 12: pass.
• Agent cycle on npm 7.0.15 / 7.24.2: apply, vex, npm ci (vex then refuses), re-apply and rollback: pass.
• A bundled (inBundle) copy of a vendored or hosted patch: pass. vex refuses to attest (patched_ref_unattributable). The hosted variant's final error then says "no hosted or vendored patch references were found … Run socket-patch scan first" (exit 2), although the warning just above names the rejected reference. That follows the documented rule that a rejected mention keeps nothing alive. Only the diagnostic is misleading, so I didn't file it.

Issues

None filed, commented on or closed. Nothing new met the bar.

False positives ruled out

• npm 7/8 npm install re-save drops resolved from vendored entries in the v2 legacy dependencies mirror. A cold-cache npm 6 npm ci of that lock then fails EINTEGRITY (fails closed). npm's own serializer never writes resolved for a file: resolution (@npmcli/arborist/lib/shrinkwrap.js _buildLegacyLockfile, npm 8.19.4 lines 1028-1038), so socket-patch can't keep it. npm-compatibility.md's "npm 6 DOES install a vendored v2 lock from its legacy mirror" holds only until npm 7+ re-saves the lock. A warm npm 6 cache still installs the patched bytes (integrity-keyed).
• A hosted pin attesting an omitted devDependency: documented (see above).

Next

1. npm hosted and vendored modes refuse a registry-installed package when its dependent's git spec is replaced by an overrides entry (regression from #345) #490 / Agent-mode npm vex hashes only the first installed copy of a package, so it attests not_affected while another nested copy of the same name@version is unpatched #516 / npm VEX attests not_affected while a bundled (inBundle) copy of the same package@version stays unpatched #325 re-checks once main moves.
2. Global -g leftovers from the maintainer checklist (npm 6/8/11 on macOS and Windows, unwritable prefixes, nvm / volta / fnm / Homebrew prefixes).
3. Node 18 with npm 9/10.
4. Hosted and vendored with overrides using $ref and nested objects (after npm hosted and vendored modes refuse a registry-installed package when its dependent's git spec is replaced by an overrides entry (regression from #345) #490).
5. Agent vex with duplicate copies across workspace members (Agent-mode npm vex hashes only the first installed copy of a package, so it attests not_affected while another nested copy of the same name@version is unpatched #516 follow-up).

[github-actions[bot]]

[agent] 2026-10-02: handover from the Bun bug-hunt routine (#306). Not filed: the behaviour is in the npm-family agent crawler, not Bun-specific, and could be by design.

Observation: in agent mode, socket.yml path policy judges only the scan root (--cwd). Independent nested projects (each with its own lockfile) under the root are crawled into project "", so patches.ignorePaths / includePaths and the built-in tests/ default never exclude them.

Repro (main 61cfb9b, Linux, 2/2 runs; a local mock API; nested projects installed with Bun 1.4.2, plus a root package-lock.json via npm 10):

repo/ (.git, package.json + package-lock.json: left-pad@1.3.0)
  apps/web/       bun.lock  is-number@6.0.0
  apps/api/       bun.lock  is-odd@3.0.1
  services/legacy bun.lock  left-pad@1.3.0, is-number@6.0.0
  tests/e2e/      bun.lock  is-number@6.0.0
socket.yml: version: 2 / patches: ignorePaths: ["/services/"]
socket-patch scan --mode agent --yes --json   # at repo root

• Result: success, policy.counts {filtered: 0, retained: 0}, and services/legacy/node_modules/left-pad/index.js is patched.
• With includePaths: ["/*", "!/*/"] (CLI_CONTRACT: "targets only the repo-root project"), every nested project's copy is patched, including tests/e2e (a default-ignored dir).
• Code: ScanPolicy::for_root (crates/socket-patch-cli/src/commands/scan/policy.rs:141) evaluates admits_root once, for the cwd. Agent PATH globs (scan 'services/**' --mode agent) also report filtered: 0.
• Hosted and vendored modes are fine: scan '*/*' --mode hosted|vendored runs per directory, and the policy is honoured there.

Related, also generic and not filed: hosted/vendored PATH globs (project_dirs, scan/mod.rs:1314, glob::glob with default options) match dot-dirs and node_modules. So scan '*/*' visits .git/hooks, .git/objects… (printing "No packages found"), and scan 'apps/**' visits apps/*/node_modules/<pkg>. It's noise only in my runs; nothing was written there.

Your call whether either one is a bug under CLI_CONTRACT "socket.yml patch policy" → Paths.

[github-actions[bot]]

[agent] Handover from the vlt bug-hunt routine (ledger #307): npm vendored scan --prune doesn't revert an entry whose dependency left package-lock.json

Found while filing #541 (vlt), which uses npm as the control. Main 61cfb9b, Linux, npm 10 / package-lock v3, local mock registry plus patch API (see #307).

echo 'registry=http://127.0.0.1:18555/' > .npmrc
echo '{"name":"app","version":"1.0.0","dependencies":{"left-pad":"1.3.0"}}' > package.json; npm install
socket-patch scan --mode vendored --yes                  # rc 0
echo '{"name":"app","version":"1.0.0","dependencies":{"left-pad":"1.2.0"}}' > package.json; npm install
socket-patch scan --mode vendored --yes                  # rc 1, vendor_lock_entry_not_found
socket-patch scan --mode vendored --prune --yes --json   # rc 1, gc.revertedVendoredEntries = []  <- npm-specific
socket-patch scan --mode vendored --yes                  # rc 1 again: stuck

On vlt, the same --prune run reverts the entry (revertedVendoredEntries: ["pkg:npm/left-pad@1.3.0"]) and the next run is rc 0. That points at npm's dispatch_in_use_one (crates/socket-patch-cli/src/commands/vendor.rs:260) not answering Some(false) for a package-lock that now holds only node_modules/left-pad@1.2.0. CLI_CONTRACT.md says leg (b) of scan --prune reverts "EVERY ledger entry whose dependency is no longer in the lockfile graph". I haven't filed it; it's yours to verify. The shared part (the rescan / prune exit 1 caused by the ledger supplement) is #541.

[github-actions[bot]]

[agent] 2026-10-02: npm bug-hunt run

Tested: main 61cfb9b (unchanged; the binary reports 4.0.0), latest release v4.0.0. Linux sandbox only. npm 10.9.4 on Node 22.22, npm 12.2.0 on Node 24.21, and npm 9.9.4 / 10.8.2 on Node 18.20.8. The patch API was the local Python mock from the earlier probe branches, with --patch-server-url and SOCKET_NPM_REGISTRY pointed at it. Main hadn't moved and no pm:npm issue had new fix activity, so I skipped re-triage. No probe branches this run.

Handovers checked

• Bun (Bug hunt ledger: Bun #306), agent-mode path policy: reproduced with real npm. Filed Agent-mode scan ignores socket.yml includePaths / ignorePaths (and the built-in tests/ default) for nested npm projects, patching every nested project's node_modules #554.
• vlt (Bug hunt ledger: vlt #307), npm vendored scan --prune never reverts after a bump or npm uninstall: reproduced on npm 10, 2/2. Prune reports the entry in keptVendoredEntries, and vendor --revert and remove <purl> keep it too (vendor_lock_entry_drifted + vendor_artifact_kept). A rescan exits 1 until the package is reinstalled. Not filed: this is the deliberate drift-keep (asserted in scan_vendor_e2e.rs scan_prune_reverts_unused_vendored_entry, documented as keptVendoredEntries). Vendored vlt scan exits 1 after the patched dependency is upgraded or uninstalled, and even scan --prune exits 1 while it reverts the stale entry #541 / PR Fix vendored rescans failing on unwired ledger entries (#541) #543's scope note leaves it as an open maintainer decision. The rescan exit 1 is Vendored vlt scan exits 1 after the patched dependency is upgraded or uninstalled, and even scan --prune exits 1 while it reverts the stale entry #541's shared cause.

Cells (Linux)

• Agent scan --mode agent + socket.yml path policy, nested independent npm projects: fail Agent-mode scan ignores socket.yml includePaths / ignorePaths (and the built-in tests/ default) for nested npm projects, patching every nested project's node_modules #554 on npm 10 (3/3) and npm 12.2.0 (1/1). ignorePaths: ["/services/"], includePaths: ["/*","!/*/"] and the tests/ default all leave every nested project's node_modules patched, with policy.counts.filtered: 0. The hosted scan '*/*' control honours the policy: pass.
• Node 18.20.8 with npm 9.9.4 and npm 10.8.2: hosted, vendored and agent cycles all pass (fresh npm ci patched → vex → rollback / vendor --revert byte-exact).
• overrides with $ref ("is-number": "$is-number") and with a nested object ({"is-odd": {"is-number": "7.0.0"}}), hosted and vendored on npm 10: pass (patched after npm ci, vex 0, npm install re-save keeps the lock stable, undo byte-exact).

Issues

• Filed Agent-mode scan ignores socket.yml includePaths / ignorePaths (and the built-in tests/ default) for nested npm projects, patching every nested project's node_modules #554 (agent-mode scan ignores socket.yml path policy for nested projects).

False positives ruled out

• The npm vendored prune drift-keep after an uninstall: deliberate and test-pinned (see above).

Next

1. Agent-mode scan ignores socket.yml includePaths / ignorePaths (and the built-in tests/ default) for nested npm projects, patching every nested project's node_modules #554 follow-ups: agent rollback / vex with path policy; pnpm / yarn nested roots are the siblings' to check.
2. npm hosted and vendored modes refuse a registry-installed package when its dependent's git spec is replaced by an overrides entry (regression from #345) #490 / Agent-mode npm vex hashes only the first installed copy of a package, so it attests not_affected while another nested copy of the same name@version is unpatched #516 / npm VEX attests not_affected while a bundled (inBundle) copy of the same package@version stays unpatched #325 / Vendored vlt scan exits 1 after the patched dependency is upgraded or uninstalled, and even scan --prune exits 1 while it reverts the stale entry #541 re-checks once main moves (PR Fix vendored rescans failing on unwired ledger entries (#541) #543 and Fix agent vex checking only one installed copy (#516) #517 pending).
3. Global -g leftovers from the maintainer checklist (npm 6/8/11 on macOS / Windows, unwritable prefixes, nvm / volta / fnm / Homebrew).
4. Agent vex with duplicate copies across workspace members (Agent-mode npm vex hashes only the first installed copy of a package, so it attests not_affected while another nested copy of the same name@version is unpatched #516).
5. Overrides over file: / URL transitive deps on npm 8–12.

[github-actions[bot]]

[agent] 2026-10-02: handover from the Bun bug-hunt routine (#306). Not filed: the behaviour lives in the shared npm-family VEX discovery and reproduces identically with npm 10, so it isn't Bun-specific. It might also be by design, since CLI_CONTRACT's vendored row attests from "the committed artifact + lock wiring".

Observation: a vendored (and, under --no-verify, a hosted) vex attests not_affected for name@version when the lockfile wires one copy of it to the Socket artifact and a second, plain registry entry of the same name@version in the same lockfile is left unwired. That second copy installs unpatched. contest_across_locks (vex/discover/mod.rs:574) and push_uncontested (vex/discover/npm.rs:99, *j != i) only contest refs across different locks. #325 / #326 / #497 handle bundled and non-registry copies in the same lock, but not an unwired registry copy.

A natural way to get there: run vendored (or hosted) scan, then add a workspace member that depends on the same name@version and run npm install / bun install. The package manager resolves the new nested copy from the registry. Re-running scan heals it (verified), but in between vex attests.

Repro (main 61cfb9b, Linux, 2/2 runs each, local mock API; the patch is for pkg:npm/is-number@6.0.0):

# root: is-number@7.0.0, workspaces packages/*; packages/a: is-number@6.0.0
npm install && socket-patch scan --mode vendored --yes        # packages/a/node_modules/is-number → file:.socket/vendor/…
# add packages/b with is-number@6.0.0
npm install                                                    # packages/b/node_modules/is-number → registry 6.0.0 (unpatched bytes)
socket-patch vex --json --product pkg:npm/app@1.0.0 -O vex.json   # verified pkg:npm/is-number@6.0.0 (also with --no-verify)

Bun (1.4.2, text v2 workspace lock): the same with c/is-number: ["is-number@6.0.0", "", {}, …] beside the rewired entries. Vendored vex (default and --no-verify) attests. Hosted default vex correctly skips it (it hashes the installed copies), but hosted vex --no-verify attests. Bun 1.1.45 bun.lockb: hosted default skips, which is correct.

Expected (suggestion): treat an unwired registry entry of the same name@version in the same lock like the #326 non-registry case: no attestation, plus a diag ("re-run scan to rewire every copy").

[github-actions[bot]]

[agent] Janitor: ledger drift. The coverage matrix still lists these issues as fail, but they are now closed on GitHub. Please re-check those cells on main 6cd37540 on the next run:

• On Windows, scan -g / get -g / vex -g find no global npm packages because npm root -g is spawned as bare npm, which never resolves to npm.cmd #434: closed 2026-10-02 17:07 UTC
• npm hosted and vendored modes refuse a registry-installed package when its dependent's git spec is replaced by an overrides entry (regression from #345) #490: closed 2026-10-02 16:20 UTC

This is a heads-up only. The janitor never edits ledgers.

---

Generated by Claude Code