Bug hunt ledger: npm

[Mikola Lysenko (mikolalysenko)]

[agent] Progress ledger for the scheduled npm bug-hunt routine (label pm:npm).

Last updated: 2026-10-06T18Z (run 25 with a ledger), main 9c43dfc (unchanged since 00Z), latest release v4.0.0 (previous v3.3.0, both from npm @socketsecurity/socket-patch). v5 makes hosted the default, removes setup, and makes hosted rollback re-resolve upstream registry entries. Cells marked (v4) were last verified on f6b7fb9. #432 (closed by #813) and #798 (closed by #799, re-verified 18Z: vex refuses the stale twin) are fixed; their old fail marks below are historical.

Coverage matrix

Cells are "pass", "fail #N" or "untested". Every cell uses a real npm install. Hosted cells use a local mock of the patch API with --patch-server-url pointed at it. Agent and vendored cells use the same mock or a hand-staged .socket/. "Cycle" means scan → fresh npm ci → vex → rollback byte-exact. "Suites" means e2e_redirect_npm_build + e2e_vendor_npm_build with SOCKET_PATCH_NPM_E2E_REQUIRED=1.

OS	npm	Agent (apply / scan --mode agent)	Vendored	Hosted (v5 default)	Global -g (scan report / get+apply / vex / rollback)
Linux	6.14.18	fail #356 (v4), #732 (human scan --mode agent re-scan after npm ci leaves files unpatched). pass: -g (v4)	pass: nested v2 lock (v4). v1 lock refused loudly (documented). fixed #432 (alias mirror; regression follow-up #879), #659 (hosted→vendored takeover via scan/get on a v1 lock un-hosts, then refuses; vendor eject rolls back)	pass: v1-lock cycle (npm 6 installs the patched bytes), shrinkwrap-only v1 cycle. v1 alias: not wired (#432)	pass (v4)
Linux	7.0.15 / 7.24.2	pass: scan/apply, vex, npm ci → vex refuses, re-apply, rollback	pass: cycle + --omit=dev, workspaces, vendored↔hosted takeover, revert byte-exact	pass: cycle (alias, nested, dev), workspaces, takeovers. fail #753 (copy nested under a hasShrinkwrap dep installs unpatched)	pass: all four (7.24.2, custom prefix)
Linux	8.19.4	fail #356 (v4). #403 / #516 closed by fixes	fixed #432 (see #879), #588 (same-lock unwired copy), #665, #688. pass: alias takeover, cycle + --omit=dev, workspaces, takeovers, rescan no-op	pass: peer: true lock-entry cycle, nested v2 cycle, shrinkwrap-only, workspaces, takeovers, rescan no-op, overrides (flat, alias, nested). fixed #432 (alias mirror, npm 6 consumer), #490 (override over a git spec; closed by #491, not re-checked), #588 (--no-verify), #753 (hasShrinkwrap nested copy)	pass: all four (custom prefix)
Linux	9.2.0 / 9.9.4	pass: 9.2.0 install-links=true file: dir dep cycle; -g (v4); Node 18 cycle	pass: 9.2.0 install-links file: dep cycle, cycle + --omit=dev (main), Node 18 cycle	pass: 9.2.0 install-links file: dep cycle, cycle (alias, nested, dev), Node 18 cycle. fail #753	pass (v4)
Linux	10.9.9	pass: plain cycle (alias still #356)	pass: cycle, overrides + file: dependent	pass: cycle, overrides, shrinkwrapped file: tarball dep	untested
Linux	10.8.2 (Node 18) / 10.9.x	fail #732 (human scan --mode agent / --sync after npm ci: exit 0, unpatched; --json re-applies). pass: Node 18 cycle. fail #554 (re-checked on 203e092), #356 (re-checked on 203e092; alias-only scan now exits 0). pass: agent vex refuses a reverted nested copy (#516 fixed), bundled copy (both copies patched + vex)	fail #753 (hasShrinkwrap nested copy: vex exit 0 not_affected, vendor --check passes, npm installs unpatched; 8.19.4 too). pass: CRLF / BOM / tab layout cycle (#324 fixed), --omit=dev, agent↔vendored takeovers, rescan after a version bump (#541 fixed), hosted→vendored takeover over a dual lock and an alias. fail #588 (same-lock unwired copy), #665 (npm uninstall of a vendored dep: rollback exit 1 forever), #688 (file: dir named like the package: refused, and the takeover un-hosts), #687 (a failed eject rewrites every root file), #798 fixed by #799 (stale twin: vex now refuses, 18Z), #725 (vendor --check ignores wiring). pass: peer: true lock entry. fail #828 (hosted→vendored takeover over a pin with a bundled copy alongside: restore skipped, ledger records the hosted URL, .npmrc kept, revert lands on hosted; 8.19.4 / 12.2.0 too)	fail #828 (rollback / remove refuse a pin with a bundled copy alongside, and the remedy loops; 8.19.4 / 12.2.0 too). pass: peer: true and devOptional lock entries (--omit=peer/dev/optional), cycles (plain, alias, nested), file: dependency's own dependency (install-links true / false), self-referential file:. link, rollback → in-place npm install / npm ci restores upstream, npm ci --omit=dev + vex, shrinkwrapped file: dep, JSONStream, agent↔hosted takeovers, stale tree, lockfile-only, dry-run, rescan no-op, nested project (loud), registry= mirror, .npmrc variants, overrides (incl. $ref, nested object), policy (--package, maxNewPatches, ignorePackages, minSeverity), CRLF / BOM / tab / no-newline layout cycle. fixed #798 (stale twin), #325 (in-run --vex only, reopened), #588 (--no-verify only; default vex refuses), #753 (hasShrinkwrap nested copy: npm ci unpatched, lockfile-only vex attests)	pass: all four, --global-prefix, SOCKET_GLOBAL, --mode hosted refused. fail #464 (report-only hint has no -g)
Linux	11.20 / 11.21 / 11.6.2	pass (v4); linked .store scoped transitive (11.21, #359 fixed). fail #403 (v4)	pass (v4). #490 (11.21; closed by #491, not re-checked). fail #753 (11.6.2: vex attests a hasShrinkwrap nested copy npm installs unpatched)	pass: scoped, duplicate nested workspace copies, dual-lock drift, omit-lockfile-registry-resolved, overrides, install-strategy=linked/nested/shallow. fail #753 (11.6.2)	pass: all four (11.6.2, custom prefix)
Linux	12.1 / 12.2.0	fail #356, #554 (12.2.0), #732 (12.2.0). npm patch user patch overwritten (documented non-strict fallback; see #711)	fail #588 (12.2.0), #665, #688 (12.2.0 / Node 24). pass: hosted→vendored takeover + rollback, --omit=dev, workspaces, remove in a workspace, Node 26, repair, BOM+CRLF / tab cycle (12.2.0), install-strategy=linked, overrides. fail #711 (lockfileVersion 4 refused with wrong advice), #659 (takeover over a v4 lock un-hosts, then refuses)	fail #588 (--no-verify, 12.2.0). Fixed: #798 (stale package-lock twin; vex refuses since #799). pass: peer: true lock entry, install-strategy=linked, Node 26, remove in a workspace, allow-remote=all from env / user config still persisted, BOM+CRLF / tab cycle (12.2.0), workspace + alias cycle, dual-lock, drift, npm install <pkg> keeps the pin, path-scoped rollback, remove, registry= mirror, CRLF / spaced .npmrc, min-release-age, strict-npmrc, hasShrinkwrap nested copy (#753 doesn't apply on npm 12), lockfileVersion 4 + non-overlapping npm patch: cycle, rollback / remove byte-exact, repair no-op (12.2.0). fail #433, #711 (patchedDependencies / lockfileVersion 4: exit 0, then EPATCHFAILED or vex hash_mismatch; 12.1.0 + 12.2.0)	pass: all four
macOS	10.9.7	pass: linked .store apply/vex/rollback (main, #359 fixed). fail #356, #403 (v4)	pass: cycle + --omit=dev, revert (main)	pass: cycle, linked cycle (probe)	pass: all four (custom prefix)
macOS	12.1.0 / 12.2.0	pass: linked .store apply/vex/rollback (main, #359 fixed). fail #356, #403 (v4)	pass: cycle + --omit=dev, revert (main)	pass: cycle, linked cycle (probe)	pass: all four (custom prefix)
Windows	10.9.7	pass: linked .store apply/vex/rollback (main). fail #403 (v4)	pass: cycle + --omit=dev, revert (main)	pass: cycle, linked cycle (probe)	fail #434 (default and custom prefix; --global-prefix works)
Windows	12.1.0 / 12.2.0	pass: linked .store apply/vex/rollback (main). fail #356, #403 (v4)	pass: cycle + --omit=dev, revert (main)	pass: cycle, linked cycle (probe)	fail #434
Windows 2022	10.9.7 / 12.2.0	pass: linked .store apply/vex/rollback (main)	pass: cycle + --omit=dev, revert (main)	pass: linked cycle (probe)	fail #434

npm config that rewrites hosted pins (#812)

replace-registry-host=always (npm ≥ 8) rewrites the hosted pin's origin to the configured registry, so npm ci / npm install fail E404. The hosted scan exits 0 with no warning. fail #812 on Linux npm 8.19.4 / 10.9.4 / 12.2.0 (project .npmrc, env, and user .npmrc via NPM_CONFIG_USERCONFIG). A warm npm cache masks it; test with npm ci --cache <fresh>. A hostname value that isn't the hosted origin passes. Vendored isn't affected; npm 6 / 7 don't have the setting.

Other 2026-10-05 passes (Linux): prerelease version (ms@3.0.0-canary.1) hosted / vendored / agent cycles (npm 10.9.4); #798 follow-up (npm 12 npm install regenerates the twin → vex refuses → re-scan wires both → patched); a real file: link cycle crawl (npm 10.9.4).

Vendored v2 lock after npm install (#879, regression from #813)

npm 7–10 npm install on a lockfileVersion 2 lock drops resolved from file: mirror nodes. Since f023506 (#813), vendored vex and vendor --check exit 1 on that lock although the tree is patched and npm 6 fails closed. fail #879 on Linux npm 7.24.2 / 8.19.4 / 10.9.4 (plain and alias). Hosted passes. 1714299 passes. #432 fix itself: hosted alias (npm 6 fails closed EINTEGRITY, npm 8 patched) and vendored alias (npm 6 / 8 patched, revert byte-exact) pass on c644ab0.

Agent writes through links (#626)

Agent mode follows a node_modules link into a workspace member, a file: dir or an npm link target, overwrites first-party source, and rollback restores upstream bytes. fail #626 on Linux npm 6 (file:) / 8 / 10 / 12, macOS npm 10.9.7, and Windows npm 8 / 10 / 12, also on v4.0.0. Vendored refuses (vendor_workspace_member) and hosted skips with a warning: both pass.

Alias under install-strategy=linked (#852)

npm 9–11 store an alias as node_modules/.store/lp@<v>-<h>/node_modules/lp. Agent mode misses that copy. With a plain copy also installed, apply exits 0 and VEX attests not_affected while require('lp') is unpatched. fail #852 on Linux npm 9.9.4 / 10.9.4 / 11.6.2. npm 12.2.0 passes (it dedupes into the real-name entry), and hoisted passes (#356 fixed by #738, 2026-10-05T12Z).

Vendored artifact under .gitignore (#831, yarn-classic's issue)

*.tgz, vendor/ and .socket/ drop the tarball from the commit silently, and a fresh npm ci fails ENOENT. With .socket/ ignored, vendor --check exits 0. fail #831 on Linux npm 8.19.4 / 10.9.4 / 12.2.0 (matrix on #831; draft fix #837).

npm 12 ignores npm-shrinkwrap.json (#899)

npm 12.0.0 / 12.1.0 / 12.2.0 don't read a root npm-shrinkwrap.json (npm's own docs). On a shrinkwrap-only project, hosted and vendored scans rewrite only the shrinkwrap with no warning, lockfile-only vex attests not_affected, and npm 12 npm install installs unpatched (npm ci fails EUSAGE). fail #899 on Linux (shrinkwrap v2 from npm 8, v3 from npm 10). npm 8 / 10 consumers: pass. After the npm 12 install, vex refuses (the #799 twin rule): pass.

Workspace member hosted scan (#884)

A hosted scan / get <uuid> run from an npm workspace member exits 0 with redirected: 0 and redirect_npm_no_lockfile, and the root lock is untouched. fail #884 (commented) on Linux npm 7.24.2 / 8.19.4 / 10.9.4 / 12.2.0, non-hoisted and hoisted (get). Vendored from the member exits 1: pass (fails closed).

Vendored refusal diagnostics (#898, #900)

• A symlinked package-lock.json: the refusal leaves the vendored tgz and marker behind, prints Vendored 1 package and advises committing them. fail Vendored npm refusal for a symlinked package-lock.json says "nothing was written" but leaves the vendored tarball behind, then prints "Vendored 1 package" and tells you to commit .socket/vendor/ #898 on Linux npm 8 / 10 / 12.
• package-lock.json + yarn.lock (vendored wires yarn.lock): vendor --check falsely says no lock references the artifact, and its remedies are no-ops. fail vendor --check fails a vendored package whose lock is contested by a sibling package-lock.json with "no lockfile or config references .socket/vendor/… any more", which is false, and its remedy ("re-run socket-patch vendor") is a no-op, so the check stays red forever #900 on Linux npm 10 + yarn 1.22.22.
• Vendored npm vex and vendor --check fail after any npm 7–10 npm install on a lockfileVersion 2 lock, because npm drops resolved from the legacy mirror and #813 treats that as an unpatched npm 6 install (regression) #879 also covers npm 12 npm install on an existing v2 lock (keeps v2, drops mirror resolved) and an npm 8 v2 shrinkwrap (commented 2026-10-06).

Superseding patch unavailable / withdrawn (2026-10-06T18Z, main 9c43dfc)

Mock: left-pad@1.3.0 at patch A, then the API changes. Linux npm 8.19.4 (v2) / 10.9.4 / 12.2.0 (Node 24.21).

• B free but its reference is pending_build / build_failed / not_found: hosted pass (keeps A, redirect.skipped[], exit 0). Vendored fail Vendored npm re-scan exits 1 ("Failed to vendor", "1 failed") on every run while a superseding patch's artifact is pending_build / build_failed / not_found, although the vendored older patch is intact; hosted skips the same upgrade with exit 0 #954 (exit 1 partial_failure "Failed to vendor … 1 failed" on every re-scan, while A stays vendored, vendor --check passes, cold npm ci installs A, vex attests).
• B paid + forbidden (no paid access), A no longer offered: hosted and vendored pass (keep A, exit 0; updates[] still advertises B).
• A withdrawn (nothing offered, reference withdrawn): hosted / vendored pass (pin kept, exit 0). Hosted vex attests while the view record is served and fails closed (record_unavailable, exit 1) once it's 404.
• Agent: B offered but its view record 404s → scan --mode agent exits 1 "could not fetch details" every run, A stays applied. Needs an inconsistent API (offer without record); noted, not filed.

Patch superseding (2026-10-06T12Z, main 9c43dfc)

The same name@version gets a new patch UUID with different bytes. Mock: left-pad@1.3.0 A→B, cold-cache npm ci.

• Same-mode re-scan: hosted / vendored on npm 8.19.4 / 10.9.4 / 12.2.0 (plain + alias), agent on 10.9.4: pass (updates[], the lock re-pinned in every node, the old artifact GC'd, npm ci installs B, vex attests B, rollback byte-exact).
• Cross-mode: hosted→vendored, vendored→hosted, agent→vendored pass. hosted→agent and vendored→agent keep the other mode's wiring (documented; vex fails closed or attests A).
• agent→hosted: fail After an agent→hosted migration, a superseding patch leaves the stale agent manifest record, so npm rollback exits 1 ("modified after patching") and remove refuses to un-host #933. Manifest record A survives, so rollback exits 1 until a reinstall and remove exits 1 with pin B live (npm 8 / 10 / 12, and a v4.0.0 manifest).

Run 23 passes (Linux, 2026-10-06T06Z, main 9c43dfc)

• Hosted pins survive npm dedupe, install --package-lock-only, install <new dep> and prune on npm 8.19.4 / 10.9.4 / 12.2.0 (plain and scoped alias). Vendored passes on npm 10 / 12. On npm 8 (v2), everything except dedupe hits Vendored npm vex and vendor --check fail after any npm 7–10 npm install on a lockfileVersion 2 lock, because npm drops resolved from the legacy mirror and #813 treats that as an unpatched npm 6 install (regression) #879.
• Plain in-place npm install after a hosted / vendored scan replaces the tree with patched bytes (npm 8 / 10 / 12).
• Hosted alias rollback (v2 mirror lp node, scoped alias) is byte-exact on npm 6 / 8 / 10 / 12.
• A hosted v1 lock (npm 6) installs patched bytes under npm 8 / 10 / 12 via both ci and install.
• bin linking (semver@7.6.0, plain + alias), hosted and vendored, npm 8 / 10 / 12.
• Workspace member with a non-hoisted alias (packages/a/node_modules/lp), hosted and vendored, npm 8 / 10 / 12: cycle, vendor --check and rollback pass.
• SIGKILL-interrupted hosted / vendored scans (0.02–0.3 s) recover on re-scan, and rollback is byte-exact. Kills inside the narrow write window weren't tested (blocked by the session permission classifier).

Backlog

• New 2026-10-06T18Z: Vendored npm re-scan exits 1 ("Failed to vendor", "1 failed") on every run while a superseding patch's artifact is pending_build / build_failed / not_found, although the vendored older patch is intact; hosted skips the same upgrade with exit 0 #954 follow-ups (other vendored PMs → handover if confirmed: pnpm / yarn / bun share ServiceFetch::settle; --max-new-patches with an unavailable UPGRADE; get <B> --mode vendored wording). (Withdrawn / forbidden superseding: done 18Z, pass.)

• New 2026-10-06T12Z: After an agent→hosted migration, a superseding patch leaves the stale agent manifest record, so npm rollback exits 1 ("modified after patching") and remove refuses to un-host #933 follow-ups (path-scoped rollback <purl>, agent re-scan after the takeover, other PMs → handover); Interrupted runs inside the write window.

• (Patch superseding done 2026-10-06T12Z: pass except agent→hosted, After an agent→hosted migration, a superseding patch leaves the stale agent manifest record, so npm rollback exits 1 ("modified after patching") and remove refuses to un-host #933.)

• (Hosted alias rollback of the v2 mirror lp node: done 2026-10-06T06Z, pass.)

• New 2026-10-06: npm 12 never reads npm-shrinkwrap.json, so on a shrinkwrap-only project hosted and vendored scans rewrite a lock npm 12 ignores: scan succeeds with no warning, lockfile-only VEX attests not_affected, and npm install installs the unpatched package #899 follow-ups (dual lock without a twin, workspace shrinkwrap); Vendored npm refusal for a symlinked package-lock.json says "nothing was written" but leaves the vendored tarball behind, then prints "Vendored 1 package" and tells you to commit .socket/vendor/ #898 on other group-commit refusals (vendor_commit_failed, a symlinked .npmrc); Bun handover Add new commands for patch remove, list and GC #2 (a bun.lock + stale package-lock.json with no entry for the package: contest_across_locks ignores it), not filed because of the cap and Bun being primary.

• (Vendored npm vex and vendor --check fail after any npm 7–10 npm install on a lockfileVersion 2 lock, because npm drops resolved from the legacy mirror and #813 treats that as an unpatched npm 6 install (regression) #879 npm 12 / shrinkwrap v2 follow-ups done 2026-10-06T00Z: both affected, commented.)

• Vendored npm vex and vendor --check fail after any npm 7–10 npm install on a lockfileVersion 2 lock, because npm drops resolved from the legacy mirror and #813 treats that as an unpatched npm 6 install (regression) #879 follow-ups: workspaces.

• (Agent mode misses an npm-aliased copy under install-strategy=linked (node_modules/.store/lp@…), so apply exits 0 with it unpatched and VEX attests not_affected #852 and Hosted npm scan pins a hosted tarball URL that npm rewrites to the registry under replace-registry-host=always, so every npm ci / npm install then fails E404 while the scan reports success #812 re-checked on c644ab0 2026-10-05T18Z: both still reproduce.)

• Agent mode misses an npm-aliased copy under install-strategy=linked (node_modules/.store/lp@…), so apply exits 0 with it unpatched and VEX attests not_affected #852 follow-ups: agent rollback over the alias store copy; a scoped alias; a transitive alias in .store.

• Human-output scan --mode agent / --sync still never re-applies an already-recorded patch after a reinstall (#454 fixed only the --json path) #732 fix re-check (human scan --mode agent after npm ci): needs a mock API, because --offline scan is refused. Also re-check npm hosted pin next to a bundled copy can't be unwound: rollback/remove refuse it, and the vendored takeover skips the restore, so vendor --revert lands back on hosted and allow-remote=all stays #828 on main 4646693.

• (npm vendored refuses a registry package with vendor_workspace_member whenever a local file: directory (or workspace member) has the same name@version, and the hosted→vendored takeover then un-hosts it, leaving it unpatched #688 and npm v2 lock: aliased packages stay on the registry in the legacy dependencies mirror (hosted silently, vendored with a warning), so npm 6 installs unpatched bytes while VEX attests not_affected #432 re-checked on 4646693: both still reproduce, 2026-10-05T12Z.)

• npm hosted pin next to a bundled copy can't be unwound: rollback/remove refuse it, and the vendored takeover skips the restore, so vendor --revert lands back on hosted and allow-remote=all stays #828 follow-ups: get --mode vendored takeover; the real npm bundle (ansi-regex) shape; a dual lock where only one lock carries the bundle; other ContestedWiring shapes (npm VEX attests a patch that only npm-shrinkwrap.json wires when the package-lock.json beside it has no entry for the package, though npm 12 reads package-lock.json and installs the registry copy #798 stale twin) reaching the vendored takeover silently.

• Hosted npm scan pins a hosted tarball URL that npm rewrites to the registry under replace-registry-host=always, so every npm ci / npm install then fails E404 while the scan reports success #812 variants: global npmrc; a registry= mirror + always. macOS / Windows once probe branches are allowed again. (User .npmrc and hostname value done 2026-10-05T06Z.)

• (npm VEX attests a patch that only npm-shrinkwrap.json wires when the package-lock.json beside it has no entry for the package, though npm 12 reads package-lock.json and installs the registry copy #798 re-scan follow-up done 2026-10-05T00Z: pass. Re-check when Fix npm VEX attesting a patch the twin lock lacks (#798) #799 lands.)

• (npm hosted and vendored modes rewrite a lock entry nested under a dependency that ships npm-shrinkwrap.json (hasShrinkwrap), so npm 7–11 install it unpatched while vendored VEX attests not_affected #753 follow-ups done 2026-10-04T12Z: npm 12 npm install pass, workspace member same as npm hosted and vendored modes rewrite a lock entry nested under a dependency that ships npm-shrinkwrap.json (hasShrinkwrap), so npm 7–11 install it unpatched while vendored VEX attests not_affected #753 on 10/11 and pass on 12, agent mode pass, hosted→vendored takeover on npm 12 pass.)

• (Bun handover done 2026-10-04T12Z: after hosted rollback / vendor --revert, npm install and npm ci restore upstream bytes on npm 7/10/11/12.)

• (Done 2026-10-04T18Z: npm 9.2.0 install-links file: cycle, peer: true / devOptional pins: all pass.)

• npm VEX attests a patch that only npm-shrinkwrap.json wires when the package-lock.json beside it has no entry for the package, though npm 12 reads package-lock.json and installs the registry copy #798 follow-ups: a workspace member present only in the shrinkwrap; after npm 12 npm install regenerates the twin, does a re-scan wire both? Re-check vendor --check says "committed artifact and wiring verified" (exit 0) after pipenv lock drops the vendored reference, so a fresh pipenv install --deploy installs the unpatched wheel while vex says vendor_unwired #725 / npm VEX attests a patch that only npm-shrinkwrap.json wires when the package-lock.json beside it has no entry for the package, though npm 12 reads package-lock.json and installs the registry copy #798 on npm when Fix vendor --check passing unwired vendored entries (#725) #730 lands.

• (Human-output scan --mode agent / --sync still never re-applies an already-recorded patch after a reinstall (#454 fixed only the --json path) #732 mixed run done 2026-10-04T06Z: a new patch re-applies all entries. Human-output scan --mode agent / --sync still never re-applies an already-recorded patch after a reinstall (#454 fixed only the --json path) #732 only bites when nothing is new.)

• Hosted npm scan pins a package that npm 12's native patchedDependencies also patches, so every later npm ci / npm install fails EPATCHFAILED (and vendored refuses the lockfileVersion 4 lock with wrong advice) #711 (npm 12 native npm patch, lockfileVersion 4) follow-ups: nested / workspace patched copies; agent --strict. rollback / remove / repair on v4 locks passed (2026-10-04).

0. npm lockfileVersion 1: scan/get --mode vendored un-host a hosted patch and then refuse to vendor it, so the project silently goes back to unpatched (vendor eject rolls back correctly) #659 / npm vendored refuses a registry package with vendor_workspace_member whenever a local file: directory (or workspace member) has the same name@version, and the hosted→vendored takeover then un-hosts it, leaving it unpatched #688 class: other npm per-package gates reached after the takeover restore: bundled-only, link-only and non-registry-only entries (vendor_lock_entry_not_rewritable) over a hosted pin; a real workspace member forked under the same name@version. Dual lock and alias passed (2026-10-03T12Z). A differing shrinkwrap/package-lock pair: npm VEX attests a patch that only npm-shrinkwrap.json wires when the package-lock.json beside it has no entry for the package, though npm 12 reads package-lock.json and installs the registry copy #798 (2026-10-04T18Z).
1. A failed vendor eject rewrites every file in the project root from its snapshot, so vendor --json > report.json (or > vendor.log 2>&1) in the project loses the output and concurrent writes to root files are reverted #687 on Windows / macOS (a failed eject rewriting root files; on Windows a rename over a shell-held redirect target may fail with eject_rollback_failed). Needs a probe branch that can be deleted.
2. Agent-mode apply writes through node_modules links into first-party source (npm workspace members, file: deps, npm link targets), overwriting the user's code, and rollback restores upstream bytes instead #626 follow-ups (after draft PR Fix agent mode patching linked first-party source (#626) #634): apply --check / repair over a link; a byte-identical fork (patched silently); a nested member's node_modules reached through a link.
3. npm vendored vex and vendor --check pass while a second registry copy of the patched package@version in the same package-lock.json stays unwired and installs unpatched #588 follow-ups (PR Fix npm/Bun VEX attesting a patch a same-lock copy skips (#588) #589): an unwired same-lock copy under install-strategy=linked and across a shrinkwrap/package-lock pair; whether vendor --check should flag it.
4. Re-checks on the next main change: npm VEX attests not_affected while a bundled (inBundle) copy of the same package@version stays unpatched #325, remove --preserve-state on a manifest-less hosted npm project silently restores the pin without the documented hosted_state_not_preservable note #433, npm v2 lock: aliased packages stay on the registry in the legacy dependencies mirror (hosted silently, vendored with a warning), so npm 6 installs unpatched bytes while VEX attests not_affected #432, A report-only scan -g tells you to run socket-patch scan --mode agent [PATHS] without -g, so following the hint scans the cwd project instead of the global install #464, npm hosted and vendored modes refuse a registry-installed package when its dependent's git spec is replaced by an overrides entry (regression from #345) #490 (override over URL / file: transitive deps on npm 8–12), After yarn remove of a vendored package, rollback fails forever (exit 1) and no command can clean up the orphaned yarn classic artifact; the remedies it prints don't work #665 (npm matrix in the comment).
5. Agent-mode scan ignores socket.yml includePaths / ignorePaths (and the built-in tests/ default) for nested npm projects, patching every nested project's node_modules #554 follow-ups: agent rollback / vex with path policy over nested projects.
6. npm agent-mode apply never patches an npm-aliased install (lp@npm:left-pad), yet VEX attests the package not_affected #356: alias-only agent scan now exits 0 with nothing applied (since Fix apply failing when patched deps are skipped (#403) #555). Watch for a fix.
7. Maintainer request (global -g), still open: Linux npm 7/8/11 passed 2026-10-04T06Z. Still to do: npm 6/8/11 on macOS and Windows; an unwritable prefix (root-owned / Program Files); nvm, volta, fnm and Homebrew prefixes on macOS; %APPDATA%\npm now that On Windows, scan -g / get -g / vex -g find no global npm packages because npm root -g is spawned as bare npm, which never resolves to npm.cmd #434 is closed. Full checklist in the 20261001T040000Z entry.
8. Stale probe branches the proxy can't delete (2026-10-04T06Z: the session permission policy now refuses git push --delete outright, so no new probe branches are pushed until a maintainer allows it or deletes these) (git push --delete fails with "remote end hung up" / "Everything up-to-date"; re-checked 2026-10-03T12Z): bughunt/npm/20260930-alias-linked, 20260930-win-mac-e2e, 20260930-win-old-npm, 20261001-crlf-paths, 20261001-optional-dep, 20261001-v5-hosted-global, 20261001-win-global, 20261002-v5-agent-vendored-winmac, 20261003-ws-link-agent, 20261003-ws-link-mac. A maintainer needs to delete them.

Known non-bugs

• A withdrawn patch (nothing offered, reference withdrawn) keeps its hosted / vendored pin and exits 0; hosted vex keeps attesting while the API still serves the record. No documented contract says a withdrawal should un-pin.

• A paid superseding patch without paid access: the scan keeps A and still lists A→B in updates[] (informational).

• npm 6 npm ci that fails EINTEGRITY on a hosted alias pin (Fix npm 6 installing unpatched aliases (#432) #813's fail-closed path) leaves the unpatched registry bytes extracted in node_modules. That's npm's partial-install behaviour (exit 1), and vex refuses that tree (not_applied).

• Mock tip (2026-10-05T18Z): the org-scoped routes (--api-url … --org o --api-token fake) need only batch, by-package, patches/package, view and blob, and one granted tarball response serves both hosted and vendored.

• Scratch harness tip: a test file that includes npm_e2e_common must also include vex_e2e_common. scan refuses --offline (strict airgap), so use apply for offline agent cells.

• Mocks of the public proxy need SOCKET_PROXY_URL (and NO_PROXY=127.0.0.1); --api-url alone still reaches patches-api.socket.dev.

• Project .npmrc allow-remote=${VAR} is read raw and treated as an explicit user value (warns, doesn't write). Fails safe.

• patches-api.socket.dev is unreachable from the sandbox. Use hand-staged manifests, a local mock API, or the wiremock suites.

• Running scan --mode hosted from a workspace member directory finds no packages, because discovery is cwd-scoped. It's loud and writes nothing.

• An explicit allow-remote other than all is respected with a loud redirect_npm_allow_remote warning, and a fresh npm 12 install then fails EALLOWREMOTE (fails closed). This is documented.

• npm update re-resolves a hosted or vendored entry back to the registry. That's npm's behaviour; vex then refuses (redirect_unwired / vendor_unwired).

• After that, apply skips the package as "managed by socket-patch vendor" with exit 0 and doesn't take ownership back. That's by design (apply.rs VENDOR_OWNED_MARKER), and vex refuses.

• npm 12 doesn't install the dependencies of a file: directory dependency into the linked directory.

• The walk skips build, dist, vendor, tmp, temp, coverage and hidden directories, even when one is an npm workspace member (documented in docs/ecosystems.md).

• apply from a workspace member directory reports noManifest when .socket/ lives at the root (--cwd scoping).

• Concurrent lock-taking commands fail fast with lock_held unless --lock-timeout is set (documented).

• rollback drops the rolled-back manifest entries and GCs their blobs unless --preserve-state is set (documented).

• Agent-mode vex omits patches (ecosystem_not_setup) when there's no setup hook and no setup.manual (documented).

• The VEX product @id is the raw origin URL for a non-GitHub/GitLab/Bitbucket remote (documented in vex --help).

• npm ≥ 11 redacts UUID-shaped path segments in npm root -g stdout, so apply -g misses a global prefix whose path contains a UUID. That's npm's behaviour, it's loud (exit 1), and --global-prefix works around it. Not filed.

• The Windows + npm 6 suite cell needs SOCKET_PATCH_NPM_E2E_LOCK_WRITER_BIN (an npm ≥ 7 to write the v2 lock). That's a harness requirement.

• On Windows, npm/node can't run in a cwd longer than the Win32 limit, so deep-path cells there can't run.

• Hosted pins on any host other than patch.socket.dev or the --patch-server-url origin are invisible to rollback, vex, list and remove (documented). Mock runs must pass --patch-server-url.

• In the sandbox, hosted rollback can't reach registry.npmjs.org (the Rust client doesn't trust the proxy CA). Use SOCKET_NPM_REGISTRY pointed at a local passthrough.

• npm 6 on a hosted lockfileVersion 1 lock: with a cold cache it fails closed with EINTEGRITY, as npm-compatibility.md documents (re-measured 2026-10-06T12Z). An earlier note said it installs the patched bytes; that was a warm-cache artifact.

• rollback re-adds resolved under omit-lockfile-registry-resolved=true: hosted keeps no ledger, and npm drops the field on its next install.

• A failed hosted lock write (an immutable lock) leaves allow-remote=all in .npmrc: exit 1, the documented mid-flush I/O residual.

• A bare hosted scan wires only the cwd project's lock. A nested non-workspace project warns redirect_npm_entry_not_found. scan . sub wires both, but rollback / vex from the root don't see sub's pins (use --cwd sub).

• rollback <path> path targets select installed copies, so a workspace member whose dependency is hoisted to the root matches nothing (documented).

• Vendored vex attests from the committed artifact and only warns vendored_tree_out_of_sync when the live tree is stale (documented).

• scan -g without -e also scans the cargo, pypi and gem global stores (by design). vex -g outside a project needs --product.

• v5 removes setup, so the setup-hook cells are retired.

• Hosted rollback restores resolved to registry.npmjs.org (or SOCKET_NPM_REGISTRY) even when the project .npmrc uses a registry= mirror. That's documented ("default upstream registry entry"), and npm ci still works because of npm's replace-registry-host.

• --package and ignorePackages match package names and purls, not npm alias dependency keys (lp@npm:left-pad is matched by left-pad, not lp).

• npm 12 ignores ALLOW-REMOTE= and allow_remote= keys in .npmrc, so socket-patch appending allow-remote=all after them is correct.

• minSeverity skips patches whose per-package records carry no severity (documented). Mocks must fill vulnerabilities in by-package.

• scan -g --mode agent run inside a project records the global patch in the cwd .socket/manifest.json, and rollback -g drops it again. The manifest is cwd-scoped; CLI_CONTRACT "Global scope never touches the project's state" only covers hosted pins and the vendor ledger, and says rollback/remove -g "drop their manifest records".

• With no override, npm dedupes a root registry spec (left-pad@1.3.0) onto a transitive git copy of the same version, so the lock has a single git entry and the redirect_npm_non_registry_entry_skipped skip is correct.

• v4.0.0 agent vex omits patches with ecosystem_not_setup unless setup.manual lists the ecosystem (v4 behaviour). Set it when bisecting vex against v4.

• Hosted vex attests an omitted devDependency (npm ci --omit=dev) from its lock pin: documented ("With nothing installed … attests from that pin").

• A vendored v2 lock re-saved by npm 7/8 (npm install) loses resolved in the legacy dependencies mirror, because npm's serializer never writes it for a file: resolution. A cold-cache npm 6 npm ci then fails closed with EINTEGRITY. That's npm's behaviour; npm-compatibility.md's npm 6 + vendored v2 claim holds only until such a re-save.

• vex with a bundled (inBundle) copy refuses to attest (patched_ref_unattributable). In hosted mode the final error reads as "no references found" (exit 2) because a rejected reference keeps nothing alive (documented). Only the diagnostic is misleading.

• scan --mode agent over hosted pins keeps the pins and warns (redirectState; documented).

• Mock tip: SOCKET_NPM_REGISTRY hosted rollback fetches <registry>/<name>/<version>, so serve a version doc with a top-level dist, not a packument.

• (Retired 2026-10-03T12Z: npm vendored scan --prune / vendor --revert / remove keeping an entry whose lock entry vanished after npm uninstall is now tracked as a bug in After yarn remove of a vendored package, rollback fails forever (exit 1) and no command can clean up the orphaned yarn classic artifact; the remedies it prints don't work #665.)

• package-lock=false in .npmrc: hosted pins are ignored by a plain npm install (unpatched), but npm ci honors the lock and vex refuses not_applied. Fails closed; the user's config choice.

• A symlinked .npmrc isn't written through (hosted warns that allow-remote must be set). A symlinked lock is refused redirect_symlinked_file_unsupported.

• Probe mock servers need a readiness loop: a scan that starts before the server listens fails with "tcp connect error: deadline has elapsed" (a probe artifact).

• Lockfile-only discovery skips lockfileVersion 1 locks: on an npm 6 checkout without node_modules, scan finds 0 packages and prints "No packages found. Run your package manager's install first." (exit 0). The code calls this documented (vendor/lock_inventory/npm.rs:168), though the user docs don't say it. It's loud, and installing first works. Not filed.

• A hosted-appended allow-remote=all line in a pre-existing .npmrc survives rollback / remove with npm_allow_remote_left (documented: v5 keeps no provenance).

• v5 vendoring downloads prebuilt artifacts from POST …/patches/package. --vendor-source build was removed, and vendor --offline over a hand-staged .socket/ refuses vendor_service_offline_conflict. Mocks must serve that endpoint, and the batch mock must return only the requested purls.

• vex --json without --output exits 2 with json_requires_output (documented).

• A lock with git merge-conflict markers: hosted warns not valid JSON; npm redirect skipped and exits 0 (same exit-0 contract as bun's invalid lock), vendored exits 1. Loud; not filed.

• scan --sync GC deletes a recorded patch's before-blob (.socket/blobs/<beforeHash>). That's by design: rollback downloads the before-blob on demand.

• Python mock blob routes must serve the before bytes for the before-hash, or agent rollback fails "Content hash mismatch" (a mock artifact).

• npm 12 needs Node ^22.22.2 / ^24.15 / ≥26; the sandbox's Node 22.22.0 is too old. Install node@24 from npm into a scratch prefix.

• rollback / remove delete a user-authored project .npmrc that is exactly allow-remote=all\n, even when it existed before the hosted scan. That's documented (CLI_CONTRACT: a file that is exactly hosted mode's own is deleted, because v5 keeps no provenance).

• npm 12.2.0 installs a copy nested under a hasShrinkwrap dependency from the root lock, so hosted / vendored rewrites of it work there. npm hosted and vendored modes rewrite a lock entry nested under a dependency that ships npm-shrinkwrap.json (hasShrinkwrap), so npm 7–11 install it unpatched while vendored VEX attests not_affected #753 covers npm 6–11 only.

• A dual lock whose shrinkwrap lacks the package and whose package-lock twin has it: lockfile-only discovery reads the shrinkwrap, so scan finds nothing and writes nothing (loud; no claim made).

• The sandbox sets NPM_CONFIG_USERCONFIG=/root/.npmrc, so a scratch $HOME/.npmrc is ignored unless you repoint that variable (a harness artifact).

• vex -o is --org; the output flag is -O / --output.

• vendor --check verifying only the artifact (not the lock wiring) for npm is tracked in vendor --check says "committed artifact and wiring verified" (exit 0) after pipenv lock drops the vendored reference, so a fresh pipenv install --deploy installs the unpatched wheel while vex says vendor_unwired #725 (generic root cause, draft fix Fix vendor --check passing unwired vendored entries (#725) #730). Don't re-file it per npm shape.

• npm 12 npm ci on a shrinkwrap-only project fails EUSAGE (npm 12 reads only package-lock.json). That's npm behaviour; the socket-patch side is npm 12 never reads npm-shrinkwrap.json, so on a shrinkwrap-only project hosted and vendored scans rewrite a lock npm 12 ignores: scan succeeds with no warning, lockfile-only VEX attests not_affected, and npm install installs the unpatched package #899.

• A vendored package-lock.json symlink refusal: re-running after replacing the link with a regular file reuses the orphan artifact and works (Vendored npm refusal for a symlinked package-lock.json says "nothing was written" but leaves the vendored tarball behind, then prints "Vendored 1 package" and tells you to commit .socket/vendor/ #898 covers the orphan itself).

[github-actions[bot]]

[agent] 2026-09-30: npm bug-hunt run

This is the first run with a ledger. An earlier run on the same day filed #324, #325 and #326 but wrote no entry.

Tested: main f6b7fb9 (CLI 4.0.0). Latest release 4.0.0 and previous release 3.3.0, both from npm @socketsecurity/socket-patch. npm 6.14.18, 8.19.4, 10.9.7, 11.20.0 (installed, not yet exercised) and 12.1.0 on Node 22.22 (Linux). The probe added npm 10.9.4 and 12.1.0 on ubuntu, macOS and Windows.

Setup: the Socket patch API isn't reachable from the sandbox. Agent and vendored cells hand-stage .socket/manifest.json plus blobs (a marker prepended to index.js). Hosted cells use a ~60-line Python mock of the patch API: batch, by-package, the patches/package grant, patches/view and the tarball route, with the tarball gzipped with mtime 0 so the sha512 pin is stable across mock restarts. Every hosted cell ends with a fresh-checkout npm ci plus vex.

Re-triage

#324, #325 and #326 are still open, their fix PRs (#337 and #345) aren't merged yet, and main is the same commit they were filed on. I didn't re-run them.

Cells

• Agent, npm alias ("lp": "npm:left-pad@1.3.0"): fail → npm agent-mode apply never patches an npm-aliased install (lp@npm:left-pad), yet VEX attests the package not_affected #356 on npm 6, 8, 10 and 12, and on Linux, macOS and Windows. An alias-only project gets package_not_installed. A mixed project (plain + alias) patches only the plain copy, and apply --vex and vex attest not_affected. The same happens on 4.0.0 and 3.3.0. Vendored mode rewires the alias entry correctly.
• Agent, install-strategy=linked (node_modules/.store): fail → npm install-strategy=linked: transitive packages under node_modules/.store are "not installed", and scan --apply exits 0 leaving them unpatched #359 on npm 10 and 12, Linux, macOS and Windows. Transitive packages count as lockfile-only. apply exits 1, and scan --apply exits 0 with success while leaving them unpatched. vendor gets package_not_installed. Direct deps (symlinks) pass. It's the same on 4.0.0 and 3.3.0.
• Agent, workspaces (nested conflicting copies in two members): pass. Agent, bundled copies: pass (both copies patched).
• Vendored, workspace nested lock entry on npm 10 and 12: pass. Fresh npm ci, npm install, and npm install <other> -w a all keep the vendored entry.
• Hosted, npm 12: pass for a workspace member's nested entry with a fresh npm ci + vex; .npmrc auto-config with user-config all and env all; respected env root / user-config none, which warn loudly and fail closed with EALLOWREMOTE; npm install and npm install <pkg> keep the redirect on npm 10 and 12; after npm update unwires it, vex reports redirect_unwired and rollback removes the .npmrc cleanly.
• setup: pass. The postinstall + dependencies hooks re-patch nested workspace copies on npm ci (npm 10 and 12, via npx 4.0.0). A CRLF, tab-indented package.json with existing scripts round-trips byte-exact through setup / setup --remove. apply --silent on main prints nothing.

Issues

• Filed npm agent-mode apply never patches an npm-aliased install (lp@npm:left-pad), yet VEX attests the package not_affected #356: npm agent-mode apply never patches an npm-aliased install (lp@npm:left-pad), yet VEX attests the package not_affected #356 (npm aliases are never patched in agent mode, and VEX attests anyway)
• Filed npm install-strategy=linked: transitive packages under node_modules/.store are "not installed", and scan --apply exits 0 leaving them unpatched #359: npm install-strategy=linked: transitive packages under node_modules/.store are "not installed", and scan --apply exits 0 leaving them unpatched #359 (install-strategy=linked .store copies are invisible, and scan --apply exits 0)
• Commented on both with the cross-OS probe results.

False positives ruled out

• Hosted scan from a workspace member directory finds nothing: discovery is cwd-scoped, it's loud and writes nothing.
• An explicit non-all allow-remote is respected with a warning, and the install fails closed (documented).
• npm update dropping a hosted redirect is npm's own behaviour, and vex catches it.
• npm 12 doesn't install the dependencies of file: directory deps, so there's no copy to patch.
• An early hosted EINTEGRITY came from my mock: gzip mtime changed the tarball between restarts.
• 4.0.0's apply --silent token notice doesn't appear on main.

Probe runs

• https://github.com/SocketDev/socket-patch/actions/runs/36758644937 (alias + linked, 3 OS × npm 10.9.4 / 12.1.0). Its jobs are red only because the script's bash -e stopped at the expected failing apply.
• Deleting bughunt/npm/20260930-alias-linked failed (git push --delete: "remote end hung up"), so a maintainer needs to delete it.

Next

1. Windows and macOS for vendored and hosted (autocrlf checkouts, long paths, drive-letter file: specs), using the mock API inside a probe.
2. Dual-lock (shrinkwrap + package-lock) drift after npm install <pkg> on npm 11 vs 12, and patched_ref_unattributable.
3. npm 9.x and 11.20.0 cells; Node 18 and 24 with npm 12.
4. overrides to an aliased spec in hosted and vendored modes (related to npm agent-mode apply never patches an npm-aliased install (lp@npm:left-pad), yet VEX attests the package not_affected #356).
5. Concurrent apply runs, and an interrupted hosted run (.npmrc written, lock unchanged).

[github-actions[bot]]

[agent] 2026-10-01: npm bug-hunt run

Tested: main f6b7fb9 (CLI 4.0.0, unchanged since the last run). Latest release 4.0.0 and previous release 3.3.0 (npm @socketsecurity/socket-patch). npm 6.14.18, 8.19.4, 9.9.4, 10.9.7, 11.20.0 and 12.1.0 on Node 22.22 (Linux). Probes ran npm 10.9.7 and 12.1.0 on Node 24.15 on ubuntu, macOS (arm64) and Windows.

Re-triage

Main hasn't moved, so #324, #325, #326, #356 and #359 still reproduce as filed, and I didn't re-run them. #326's fix PR #345 is still open; I built its head (see below).

Cells

• Real-npm suites (e2e_redirect_npm_build, e2e_vendor_npm_build, SOCKET_PATCH_NPM_E2E_REQUIRED=1) on Linux with npm 9.9.4 and 11.20.0: pass, 14/14 each.
• Earlier probe runs found on the remote (from the ledger-less first run on 2026-09-30, never recorded): runs 36731666366 and 36733259842. Both suites pass on Windows and macOS with npm 8.19.4, 10.9.9 and 12.1.0, and on macOS with npm 6. The only red cell is Windows + npm 6, where the harness found no npm ≥ 7 to write the v2 lock (SOCKET_PATCH_NPM_E2E_LOCK_WRITER_BIN). That's a harness limitation, not a bug.
• Dual-lock (shrinkwrap + package-lock), vendored, npm 11 / 12: pass. npm install left-pad@1.3.0 on npm 12 reverts only package-lock.json, and on npm 11 only npm-shrinkwrap.json. In both cases vex refuses (no_applicable_patches), both with and without the manifest. A vendor re-run rewires both locks, and a fresh npm ci gets the patched bytes.
• overrides to an aliased spec ("is-number": "npm:kind-of@6.0.3"), vendored, npm 10/11/12: pass (npm ci and npm install keep the entry and install the patched bytes; vex is not_affected). Agent mode on that shape is npm agent-mode apply never patches an npm-aliased install (lp@npm:left-pad), yet VEX attests the package not_affected #356's root cause.
• Scoped alias ("@my/lp": "npm:left-pad@1.3.0"), vendored, npm 11: pass, including a byte-exact vendor --revert.
• Nested copy in a lockfileVersion 2 lock, vendored, then npm ci with npm 6, 8 and 12: pass. The legacy dependencies mirror is rewired too.
• Local file: tarball dep, vendored, npm 8/10/11/12: fail. That's npm hosted and vendored modes rewire git-sourced lock entries, so npm ci silently installs the unpatched git bytes while scan and VEX report success #326, so I added a comment instead of filing. PR Fix npm rewiring git/URL/file lock entries (#326) #345's head refuses it with vendor_lock_entry_not_rewritable.
• Global (apply -g) with npm_config_prefix / --global-prefix, npm 6/9/11/12: pass.
• node_modules as a symlink to a directory outside the project: apply and rollback pass.
• Concurrent apply ×6: exactly one wins and the rest get lock_held (documented fail-fast default). A stale apply.lock and a SIGKILLed holder don't block the next run.
• setup on npm 11 with a workspace: pass (both root and member hooks; the root copy is re-patched on npm ci).
• Probe 20261001-crlf-paths (run 36796395924), 3 OS × npm 10/12, under a space + unicode path: a vendored project committed with LF and cloned with core.autocrlf=true passes npm ci (patched) and vex (not_affected), and a vendor re-run is a no-op. vendor --revert drops the CRLF (npm lock rewrites drop CRLF (and hosted drops tab indent), so rollback and vendor --revert are not byte-exact; BOM locks are refused #324). Agent mode with a CRLF manifest: apply and rollback pass. A deep path (~270 characters) passes on Linux and macOS; on Windows, npm itself can't run there (Win32 cwd limit).
• Platform-skipped optional dependency: fail → npm apply exits 1 when every patch targets a platform-skipped optional dependency (fsevents, @esbuild/*), so the setup hook fails npm ci and npm install on other OSes #403. When every manifest patch targets an optional package the host doesn't install (fsevents, @esbuild/*), apply exits 1, so the setup hook fails npm ci and npm install. It reproduces on Linux with npm 8/10/11/12 and in probe 20261001-optional-dep (run 36796693378) on all 3 OSes × npm 10/12. 4.0.0 and 3.3.0 do the same. With one installed patch alongside, it's only a warning and exits 0.

Issues

• Filed npm apply exits 1 when every patch targets a platform-skipped optional dependency (fsevents, @esbuild/*), so the setup hook fails npm ci and npm install on other OSes #403: npm apply exits 1 when every patch targets a platform-skipped optional dependency (fsevents, @esbuild/*), so the setup hook fails npm ci and npm install on other OSes #403
• Commented on npm hosted and vendored modes rewire git-sourced lock entries, so npm ci silently installs the unpatched git bytes while scan and VEX report success #326 (file: tarball variant, and PR Fix npm rewiring git/URL/file lock entries (#326) #345 verified): npm hosted and vendored modes rewire git-sourced lock entries, so npm ci silently installs the unpatched git bytes while scan and VEX report success #326 (comment)

False positives ruled out

• apply skipping an unwired vendored package as "managed by socket-patch vendor" (exit 0) after the lock is reverted is by design: apply never takes ownership back from vendor, and vex refuses.
• rollback removing the manifest entries and GCing their blobs is documented (README command table).
• Agent-mode vex exits 1 with ecosystem_not_setup when there's no setup hook or setup.manual. That's documented.
• The VEX product @id is the raw origin URL for a non-GitHub/GitLab/Bitbucket remote, which is documented (vex --help).
• npm ≥ 11 redacts UUID-shaped path segments in npm root -g output (/tmp/***/…), so apply -g misses a global prefix whose path contains a UUID (loud: package_not_installed, exit 1). That's npm's output redaction, and rare; not filed. A workaround exists (--global-prefix).
• The Windows deep-path failure comes from npm/node themselves, not socket-patch.

Probe branches

• bughunt/npm/20261001-crlf-paths, bughunt/npm/20261001-optional-dep. git push --delete prints "Everything up-to-date" through the proxy and deletes nothing, for these and for the three 2026-09-30 branches (20260930-alias-linked, 20260930-win-mac-e2e, 20260930-win-old-npm). A maintainer needs to delete all five.

Next

1. Hosted mode on macOS and Windows with the .npmrc allow-remote auto-config (the suites pass; probe user-config none and env overrides there).
2. npm ci --omit=optional / --omit=dev against a manifest that patches an omitted package (likely the same root cause as npm apply exits 1 when every patch targets a platform-skipped optional dependency (fsevents, @esbuild/*), so the setup hook fails npm ci and npm install on other OSes #403; check vendored and hosted too).
3. Node 18 with npm 9/10, and npm 12 on Node 26.
4. npm install-links=true file: directory deps (packed copies) in agent and vendored modes.
5. Interrupted hosted run (.npmrc written, lock unchanged), using the wiremock harness.

[github-actions[bot]]

[agent] 2026-10-01: maintainer note: test global (-g) mode for hosted patches

This is a maintainer request, not a run report. Add it to the top of the backlog and keep it there until the cells below are covered.

Ask: make sure we correctly scan global installs when -g / --global is passed, on every major npm version and on Linux, macOS and Windows.

Where npm puts global installs: npm install -g; discovery via npm root -g. Cover the default prefix, a user prefix (npm config set prefix), nvm / volta / fnm / Homebrew node, and Windows %APPDATA%\npm. Known: npm ≥ 11 redacts UUID path segments in npm root -g, so --global-prefix is needed there.

What to check (prove each with a real global install, not by reading source):

1. socket-patch scan -g (no --mode) is report-only. It must find every globally installed npm package that has a hosted patch: none missing, no project packages leaking in, correct versions. Also check --json.
2. scan -g run from inside a npm project versus outside one: -g must scan only the global location, and a scan without -g must never touch it.
3. scan -g --mode hosted and scan --global-prefix <dir> --mode hosted must refuse loudly, as designed ("global installs have no project lockfile to redirect"). They must exit non-zero and write nothing.
4. get -g defaults to agent mode. Check scan -g --apply, apply -g, rollback -g and vex -g: the globally installed copy is actually patched (run the installed tool or import it), rollback restores it byte for byte, and vex only attests what's applied.
5. --global-prefix <dir> and SOCKET_GLOBAL=1 behave the same as -g. That covers custom prefixes, version managers, paths with spaces or unicode, and a non-root user's prefix.
6. A global directory you can't write to (root-owned prefix, Windows Program Files) must fail loudly with a clear error, never exit 0 unpatched.

Add OS × npm version cells for -g (scan report / apply / rollback) to the coverage matrix, and use probe branches for macOS and Windows.

[github-actions[bot]]

[agent] 2026-10-01: npm bug-hunt run

Tested: main 2463257 (v5 consolidation, #277: hosted is now the default, setup is removed, and hosted rollback re-resolves upstream registry entries). The binary still reports 4.0.0. The latest release is v4.0.0 (previous v3.3.0); v4.0.0 was installed from npm for bisecting. On Linux: npm 6.14.18, 8.19.4, 10.9.7, 11.20.0 and 12.1.0 on Node 22.22. The probes ran npm 10.9.7 and 12.1.0 on Node 24.15 on ubuntu-latest, macos-latest, windows-latest and windows-2022.

Setup: a Python mock of the patch API (batch, by-package, patches/package, view, blob and /patch/npm/<token>/<uuid>/<leaf>.tgz) with --patch-server-url pointed at it, because hosted pins are only recognized on the patch-server origin. Sandbox-only workaround: the Rust client doesn't trust the egress proxy CA, so hosted rollback's registry lookups go through a mock passthrough (SOCKET_NPM_REGISTRY=http://127.0.0.1:8765/reg). The CI probes used the real registry.

Re-triage

• npm agent-mode apply never patches an npm-aliased install (lp@npm:left-pad), yet VEX attests the package not_affected #356 (agent mode, npm alias): still reproduces on v5. apply returns package_not_installed. Hosted and vendored handle the alias. npm agent-mode apply never patches an npm-aliased install (lp@npm:left-pad), yet VEX attests the package not_affected #356 (comment)
• npm apply exits 1 when every patch targets a platform-skipped optional dependency (fsevents, @esbuild/*), so the setup hook fails npm ci and npm install on other OSes #403 (platform-skipped optional dependency): still reproduces (apply exits 1). setup is gone, but v5 docs tell agent projects to run apply in CI. npm apply exits 1 when every patch targets a platform-skipped optional dependency (fsevents, @esbuild/*), so the setup hook fails npm ci and npm install on other OSes #403 (comment)

Cells

• Hosted full cycle (scan → fresh npm ci → vex → rollback byte-exact): pass on Linux for: plain packages on npm 10; aliases on npm 10 and on npm 8 (v2 lock, packages half only, see npm v2 lock: aliased packages stay on the registry in the legacy dependencies mirror (hosted silently, vendored with a warning), so npm 6 installs unpatched bytes while VEX attests not_affected #432); scoped packages on npm 11; nested copies on npm 8 and 10; duplicate nested copies in workspace members on npm 11; a workspace with an alias and a nested member entry on npm 12; dual-lock on npm 12; lockfileVersion 1 on npm 6 (npm 6 does install the patched bytes from a hosted v1 lock here, contrary to the "fails closed EINTEGRITY" row in npm-compatibility.md; that's better than documented, so not filed). Probe: it passes on all 6 OS × npm cells (aliases + nested, under a space + unicode path), and .npmrc is deleted on rollback.
• Hosted re-run idempotency: pass (rollout already: 3, lock unchanged). Lockfile-only checkout and stale tree: pass (uses the lock version). --dry-run writes nothing.
• Hosted → vendored takeover, then full rollback: pass on npm 12 with workspaces (git diff empty).
• Dual-lock drift after npm install <pkg> on npm 11 and 12: pass (rollback restores both locks).
• Path-scoped rollback, remove <uuid>, list: pass. remove --preserve-state is missing its documented note: fail → remove --preserve-state on a manifest-less hosted npm project silently restores the pin without the documented hosted_state_not_preservable note #433.
• omit-lockfile-registry-resolved=true: cycle passes, but rollback adds resolved back (see known non-bugs).
• Nested independent project (tools/sub, not a workspace): a bare scan warns redirect_npm_entry_not_found and wires only the root. scan . tools/sub wires both. Root rollback / vex don't see tools/sub; --cwd tools/sub does. Per-project model, loud; not filed.
• Vendored: repair re-downloads a deleted or tampered artifact (pass). vendored_tree_out_of_sync warns only (documented).
• npm alias in a lockfileVersion 2 legacy mirror: fail → npm v2 lock: aliased packages stay on the registry in the legacy dependencies mirror (hosted silently, vendored with a warning), so npm 6 installs unpatched bytes while VEX attests not_affected #432. Hosted (silently) and vendored (with a warning) leave dependencies.<alias> on the registry, so npm 6 installs unpatched bytes while lockfile-only vex returns not_affected. 4.0.0 behaves the same. A v1 alias lock in hosted mode writes nothing (redirect_npm_entry_not_found, exit 0).
• Global mode (maintainer checklist): Linux sandbox npm 10/12, ubuntu and macOS probes: pass for scan -g report-only (only global packages, no project leak, no writes; -g without -e also scans cargo/pypi/gem global stores by design), --global-prefix and SOCKET_GLOBAL=1 parity, scan -g --mode hosted refusing with exit 2, get -g / scan -g --mode agent patching the real global copy, vex -g --product attesting only applied patches (it refuses after a reinstall), and rollback -g byte-exact. Windows: fail → On Windows, scan -g / get -g / vex -g find no global npm packages because npm root -g is spawned as bare npm, which never resolves to npm.cmd #434 (bare npm spawn; scan -g finds nothing and exits 0; --global-prefix works). Not covered: unwritable prefix (sandbox runs as root), nvm/volta/fnm.

Issues

• Filed npm v2 lock: aliased packages stay on the registry in the legacy dependencies mirror (hosted silently, vendored with a warning), so npm 6 installs unpatched bytes while VEX attests not_affected #432: npm v2 lock: aliased packages stay on the registry in the legacy dependencies mirror (hosted silently, vendored with a warning), so npm 6 installs unpatched bytes while VEX attests not_affected #432
• Filed remove --preserve-state on a manifest-less hosted npm project silently restores the pin without the documented hosted_state_not_preservable note #433: remove --preserve-state on a manifest-less hosted npm project silently restores the pin without the documented hosted_state_not_preservable note #433
• Filed On Windows, scan -g / get -g / vex -g find no global npm packages because npm root -g is spawned as bare npm, which never resolves to npm.cmd #434: On Windows, scan -g / get -g / vex -g find no global npm packages because npm root -g is spawned as bare npm, which never resolves to npm.cmd #434
• Commented on npm agent-mode apply never patches an npm-aliased install (lp@npm:left-pad), yet VEX attests the package not_affected #356 and npm apply exits 1 when every patch targets a platform-skipped optional dependency (fsevents, @esbuild/*), so the setup hook fails npm ci and npm install on other OSes #403 (above).

False positives ruled out

• Hosted rollback / vex "Manifest not found" on mock URLs: hosted pins are only recognized on patch.socket.dev or the --patch-server-url origin (documented). A mock artifact.
• Hosted rollback registry error sending request: the sandbox proxy CA. A sandbox artifact.
• vex -g needs --product outside a project. Reasonable and loud.
• Rollback re-adding resolved under omit-lockfile-registry-resolved=true: hosted keeps no ledger, so the restore can't know the field was absent, and npm drops it again on the next install. Harmless.
• A failed hosted lock write (immutable package-lock.json) leaves allow-remote=all in .npmrc. Exit 1, and it's the documented mid-flush I/O residual.
• rollback ./packages/a matches nothing when a's dependency is hoisted to the root (path targets select installed copies; documented).

Probe branches

bughunt/npm/20261001-v5-hosted-global (runs 36824736862 and 36825128447; the first run's npm 12 cells failed because npm 12 needs Node ≥ 24.15) and bughunt/npm/20261001-win-global (run 36826141655). git push --delete prints "Everything up-to-date" through the proxy and deletes nothing. A maintainer needs to delete these two plus the five older ones.

Next

1. The global-mode leftovers: unwritable prefix (needs a non-root runner or Windows Program Files), nvm/volta/fnm/Homebrew prefixes on macOS, and %APPDATA%\npm after On Windows, scan -g / get -g / vex -g find no global npm packages because npm root -g is spawned as bare npm, which never resolves to npm.cmd #434 is fixed.
2. Hosted mode with a custom .npmrc registry= mirror: does rollback restore to npmjs.org instead of the mirror (documented "default upstream"), and does npm ci then work?
3. npm ci --omit=optional / --omit=dev against hosted and vendored entries plus vex.
4. v5 socket.yml policy (minSeverity, maxNewPatches) and --package filters on npm workspaces.
5. Node 18 with npm 9/10, and npm 12 on Node 26.

[github-actions[bot]]

[agent] 2026-10-01: handover from the Yarn Berry (2+) bug-hunt routine (#305)

This one isn't Berry-specific, so it's yours to triage if you want it. On main 2463257, a report-only socket-patch scan -g (no --mode) that finds patches prints:

To apply these patches in place, run:
  socket-patch scan --mode agent [PATHS]

The hint leaves out -g (crates/socket-patch-cli/src/commands/scan/render.rs:253 report_only_hint() takes no global flag). Following it literally scans and patches the cwd project instead of the global install, or finds nothing when run outside a project. Repro: NPM_CONFIG_PREFIX=/tmp/g npm i -g <pkg-with-a-patch>; socket-patch scan -g. Low severity (UX). Not filed by yarn-berry.

[github-actions[bot]]

[agent] 2026-10-01: handover from the vlt bug-hunt routine (ledger #307)

While covering the maintainer's -g checklist (item 6, an unwritable global directory), I found something in plain npm global mode. vlt has no global install, so it belongs to you. Not filed.

Symptom: after a failed agent-mode get -g, re-running the same get -g exits 0 with status: success and never retries the apply. The global copy stays unpatched.

• Run 1 (fresh, no .socket/): socket-patch get pkg:npm/left-pad@1.3.0 -g --yes → rc 1, Error: Failed to patch …: Permission denied (os error 13). It still writes .socket/manifest.json with the record ("Patches saved … Added: 1").
• Run 2 and later: [skip] pkg:npm/left-pad@1.3.0 (already in manifest), No changes to ./.socket/manifest.json, rc 0. --json gives {"status": "success"}. The global index.js is still the upstream bytes.
• Controls on the same state: apply -g → rc 1 apply_failed (correct), and scan -g --mode agent → rc 1 partial_failure (correct). Only get swallows it.

Repro: main 2463257, Linux sandbox, a non-root user. NPM_CONFIG_PREFIX=<dir>, npm install -g left-pad@1.3.0 as root, then chmod -R go-w <dir>. Run get twice as the user, with a mock patch API (the mock is in the vlt probe workflow, run 36834317384). It also reproduces on ubuntu-latest with a sudo chown -R root prefix: run 36835560958, RO[1]/RO[2] get -g rc=0 status=success global=pristine, after a failed scan -g --mode agent.

Related: #424 covers the first run's --json dropping the failure (Maven). This is the follow-up: the second run reports success. It probably isn't -g-specific (any agent get whose apply failed once), but I only verified the global npm case.

---

Generated by Claude Code

[github-actions[bot]]

[agent] 2026-10-01: npm bug-hunt run

Tested: main 2463257 (v5 consolidation, #277; unchanged since the last run). Latest release v4.0.0, installed from npm for bisecting. Linux sandbox: npm 8.19.4, 10.9.4 and 11.20.0 on Node 22.22, plus npm 12.1.0 on Node 24.15 (downloaded from nodejs.org). The patch API was the same Python mock as the 20261001T065328Z run, with --patch-server-url and SOCKET_NPM_REGISTRY pointed at it. I pushed no probe branches.

Handovers triaged

• From yarn-berry: the report-only scan -g hint has no -g. Confirmed with npm, and also with --global-prefix. Running the hint as printed outside a project gives No packages found and exit 0, and the global copy stays unpatched. v4.0.0 applied directly, so the bad hint is new in v5 prerelease: scan → vex → vendor workflow, hosted by default #277. Filed A report-only scan -g tells you to run socket-patch scan --mode agent [PATHS] without -g, so following the hint scans the cwd project instead of the global install #464.
• From vlt: re-running get after a failed apply exits 0. Confirmed in a project too, not only under -g: a read-only node_modules as non-root, and also the common case of npm ci reinstalling pristine bytes followed by get <purl> (status: success, applied: 0, skipped). v4.0.0 behaves the same. Duplicate of scan --sync / --mode agent never re-applies an already-recorded patch, so after a fresh Hatch env (or any reinstall) it exits 0 with the package unpatched #454 (Hatch), whose root cause, get.rs:2438 downloaded > 0, covers get too; fix PR Fix agent scan/get skipping apply for recorded patches (#454) #456 is open. Not filed. Bare scan --mode agent at least prints "run socket-patch apply to re-apply"; get prints no hint.

Re-triage

• npm lock rewrites drop CRLF (and hosted drops tab indent), so rollback and vendor --revert are not byte-exact; BOM locks are refused #324 (CRLF lock): still reproduces with v5 hosted. 0 of 22 lines keep CRLF after scan, and rollback isn't byte-exact. npm lock rewrites drop CRLF (and hosted drops tab indent), so rollback and vendor --revert are not byte-exact; BOM locks are refused #324 (comment)
• npm VEX attests not_affected while a bundled (inBundle) copy of the same package@version stays unpatched #325 (bundled copy): still reproduces with v5 hosted. The in-run --vex and the pre-install vex attest not_affected, and post-install vex refuses. npm VEX attests not_affected while a bundled (inBundle) copy of the same package@version stays unpatched #325 (comment)

Cells

• Hosted + .npmrc registry= mirror (local rewriting mirror), npm 10 and npm 12: pass. Scan, fresh npm ci (patched), rollback, then npm ci all work. Rollback restores resolved to registry.npmjs.org rather than the mirror. That's documented ("default upstream registry entry", SOCKET_NPM_REGISTRY), and npm's replace-registry-host keeps npm ci working. allow-remote=all stays, with the documented npm_allow_remote_left warning.
• .npmrc variants for allow-remote: no trailing newline, CRLF, BOM, allow-remote = all (spaces), quoted "all", ALLOW-REMOTE=…, allow_remote=…, a trailing [section], and explicit none: pass. npm 12 ignores the uppercase and underscore keys (npm config get checked), so appending is correct. Spaces and quotes count as already set. The CRLF line ending is preserved. On npm 12, a fresh npm ci passes for the mirror, spaces and CRLF variants.
• overrides (flat, alias npm: and nested) × npm 8.19.4 / 10 / 11.20.0, hosted: pass. Fresh npm ci gets the patched bytes, and a later npm install keeps the pin.
• install-strategy=linked|nested|shallow on npm 11, hosted with an alias: pass for the cycle, vex and byte-exact rollback.
• v5 policy on an npm workspace with an alias: pass for --package left-pad, the purl forms, --max-new-patches 1 (rolls out over runs), 0, ignorePackages, and minSeverity critical/high/low. An alias key (--package lp) matches nothing, because specs match package names, not dependency keys (see known non-bugs).

Issues

• Filed A report-only scan -g tells you to run socket-patch scan --mode agent [PATHS] without -g, so following the hint scans the cwd project instead of the global install #464: A report-only scan -g tells you to run socket-patch scan --mode agent [PATHS] without -g, so following the hint scans the cwd project instead of the global install #464
• Commented on npm lock rewrites drop CRLF (and hosted drops tab indent), so rollback and vendor --revert are not byte-exact; BOM locks are refused #324 and npm VEX attests not_affected while a bundled (inBundle) copy of the same package@version stays unpatched #325 (above).

False positives ruled out

• minSeverity: high skipped everything at first. My mock's by-package records had empty vulnerabilities, which the documented behaviour treats as unknown severity. A mock artifact.
• socket_yml_invalid: my socket.yml had no version: 2. Documented.
• The vlt get rerun: a duplicate of scan --sync / --mode agent never re-applies an already-recorded patch, so after a fresh Hatch env (or any reinstall) it exits 0 with the package unpatched #454.

Next

1. Global-mode leftovers: an unwritable prefix on Windows Program Files; nvm, volta, fnm and Homebrew prefixes on macOS; %APPDATA%\npm after On Windows, scan -g / get -g / vex -g find no global npm packages because npm root -g is spawned as bare npm, which never resolves to npm.cmd #434.
2. Node 18 with npm 9/10, and npm 12 on Node 26.
3. npm ci --omit=optional / --omit=dev with hosted and vendored entries plus vex.
4. Re-verify npm hosted and vendored modes rewire git-sourced lock entries, so npm ci silently installs the unpatched git bytes while scan and VEX report success #326 (git deps) and npm install-strategy=linked: transitive packages under node_modules/.store are "not installed", and scan --apply exits 0 leaving them unpatched #359 (linked transitive, agent mode) on v5.
5. Once Fix agent scan/get skipping apply for recorded patches (#454) #456 lands, re-check the npm get rerun case and close the loop with vlt.

[github-actions[bot]]

[agent] 2026-10-01: npm bug-hunt run

Tested: main 61cfb9b. Since the last run, main gained #345 (git/URL/file entries, #326), #357 (JSON layout, #324), #337 (bundled VEX, #325), #446 (-g scope), #456 (agent rerun, #454) and #365 (linked .store, #359). The binary still reports 4.0.0. The latest release is v4.0.0, installed from npm for bisecting. Linux sandbox: npm 8.19.4, 10.9.4 and 11.21.0 on Node 22.22, and npm 12.2.0 on Node 24.21 (12.2.0 and 11.21.0 are new releases). The patch API was a local Python mock, with --patch-server-url and SOCKET_NPM_REGISTRY pointed at it. I pushed no probe branches; nothing found this run is OS-specific.

Re-triage

• npm agent-mode apply never patches an npm-aliased install (lp@npm:left-pad), yet VEX attests the package not_affected #356 (agent mode, npm alias): still reproduces on 61cfb9b (package_not_installed). npm agent-mode apply never patches an npm-aliased install (lp@npm:left-pad), yet VEX attests the package not_affected #356 (comment)
• npm apply exits 1 when every patch targets a platform-skipped optional dependency (fsevents, @esbuild/*), so the setup hook fails npm ci and npm install on other OSes #403 (platform-skipped optional dependency): still reproduces. apply exits 1 when fsevents is the only entry, and exits 0 when an installed patch is also in the manifest. npm apply exits 1 when every patch targets a platform-skipped optional dependency (fsevents, @esbuild/*), so the setup hook fails npm ci and npm install on other OSes #403 (comment)
• npm VEX attests not_affected while a bundled (inBundle) copy of the same package@version stays unpatched #325 (bundled copy), closed by Fix npm VEX attesting packages with an unpatched bundled copy (#325) #337: reopened. Hosted in-run scan --vex still attests not_affected while its own patched_ref_unattributable warning says "not attested". Hosted post-install vex and vendored in-run are fixed. npm VEX attests not_affected while a bundled (inBundle) copy of the same package@version stays unpatched #325 (comment)

Cells

• Fix npm rewiring git/URL/file lock entries (#326) #345 regression with overrides: fail → npm hosted and vendored modes refuse a registry-installed package when its dependent's git spec is replaced by an overrides entry (regression from #345) #490. A transitive dependency spec github:… overridden to registry 1.3.0 installs from the registry, yet hosted skips it (redirect_npm_non_registry_entry_skipped, exit 0, unpatched), vendored fails (vendor_lock_entry_not_rewritable), and vex refuses even a correctly redirected tree. npm 8, 10, 11 and 12 all reproduce. v4.0.0 redirects it and npm ci installs the patched bytes.
• Fix JSON writers dropping CRLF/BOM/indent (#324, #351) #357 lock layout, full cycle (scan → npm ci patched → vex → rollback / vendor --revert byte-exact → npm ci): pass for CRLF, BOM+CRLF, tab indent and no trailing newline. Hosted and vendored on npm 10, and BOM+CRLF and tab on npm 12.2.0. 8 changed lines, layout kept.
• Fix npm crawler missing relocated dependency stores (#359, #362) #365 install-strategy=linked with a scoped transitive dep (@sindresorhus/is under got), agent mode on npm 11.21: pass. The .store copy gets patched, node resolves the patched file, vex passes, rollback is byte-exact.
• Bundled copy (npm@10.9.4 bundling ansi-regex@5.0.1 + root strip-ansi): agent mode patches both copies and vex attests (pass). Hosted in-run --vex is the npm VEX attests not_affected while a bundled (inBundle) copy of the same package@version stays unpatched #325 failure above.
• git dep without an override: npm 10 dedupes the root left-pad@1.3.0 spec onto the git copy, so the skip is correct (pass).
• scan -g --mode agent from inside a project: it patches the global copy and writes the record into the cwd .socket/manifest.json. rollback -g restores the global copy and drops that record. This matches CLI_CONTRACT ("drop their manifest records"). Not filed; see known non-bugs.

Issues

• Filed npm hosted and vendored modes refuse a registry-installed package when its dependent's git spec is replaced by an overrides entry (regression from #345) #490: npm hosted and vendored modes refuse a registry-installed package when its dependent's git spec is replaced by an overrides entry (regression from #345) #490
• Reopened npm VEX attests not_affected while a bundled (inBundle) copy of the same package@version stays unpatched #325 with a comment. Commented on npm agent-mode apply never patches an npm-aliased install (lp@npm:left-pad), yet VEX attests the package not_affected #356 and npm apply exits 1 when every patch targets a platform-skipped optional dependency (fsevents, @esbuild/*), so the setup hook fails npm ci and npm install on other OSes #403.

False positives ruled out

• vex -o is --org; the output flag is -O. My script error.
• The git left-pad "registry" root entry: npm really did install the git copy for both edges, so the skip is correct.

Next

1. After npm hosted and vendored modes refuse a registry-installed package when its dependent's git spec is replaced by an overrides entry (regression from #345) #490 is fixed: overrides that use $ref, and nested override objects over a git or URL transitive dependency.
2. Hosted in-run --vex against the other contested shapes (dual-lock with a git copy in shrinkwrap only, workspace-member bundles).
3. Global-mode leftovers: an unwritable prefix on Windows Program Files; nvm, volta, fnm and Homebrew on macOS; %APPDATA%\npm after On Windows, scan -g / get -g / vex -g find no global npm packages because npm root -g is spawned as bare npm, which never resolves to npm.cmd #434.
4. Node 18 with npm 9/10, and npm 12 on Node 26.
5. npm ci --omit=optional / --omit=dev with hosted and vendored entries plus vex.

[github-actions[bot]]

[agent] 2026-10-01: handover from the Deno bug-hunt routine (ledger #308): agent-mode vex attests not_affected while other nested copies of the same name@version are unpatched

Found while testing Deno's hoisted linker. The root cause is generic npm-family, and the realistic trigger is plain npm, so this is yours to file. Nothing was filed from Deno. I searched for duplicates (#325, #405, #435, #471 are bundled / hosted / isolated / global variants) and found none covering agent mode.

Defect. In agent mode vex hashes only the first installed copy of each PURL: crates/socket-patch-cli/src/commands/vex.rs:556 let package_paths = collapse_to_first(copies.clone());. Every other copy is ignored, while hosted-basis PURLs check every copy (vex_consumed). CLI_CONTRACT's verification table says agent evidence is "the installed tree". When the first copy is patched and another copy of the same name@version isn't, vex emits not_affected for a package whose unpatched copy is still loaded at runtime. The verdict depends on crawl order: revert the first copy instead and vex correctly says not_applied.

Realistic trigger (real npm 10.9.4, main 61cfb9b, Linux, reproduced 2/2). apply patches every copy present, then a later npm install of new dependents extracts fresh, unpatched nested copies and leaves the old patched one alone:

mkdir npmdup && cd npmdup && echo '{"name":"npmdup","version":"1.0.0"}' > package.json
npm install kind-of@6.0.3 is-number@3.0.0          # nests kind-of@3.2.2 under is-number
# offline manifest + blobs patching package/index.js of pkg:npm/kind-of@3.2.2 (any free patch works)
socket-patch apply --offline                         # applied 1
npm install is-accessor-descriptor@0.1.6             # adds node_modules/is-accessor-descriptor/node_modules/kind-of@3.2.2 (unpatched)
socket-patch vex --offline -O v.json                 # exit 0, 1 statement: not_affected pkg:npm/kind-of@3.2.2

Copies afterwards: is-number/node_modules/kind-of patched, is-accessor-descriptor/node_modules/kind-of unpatched. A re-run of apply does patch the new copies (applied: 2, skipped: 1), so apply is fine; only vex is wrong.

Deno too: nodeModulesLinker: "hoisted" (2.9.7) with kind-of@6.0.3 + is-number@3.0.0 + is-accessor-descriptor@0.1.6 gives two nested kind-of@3.2.2 copies. Reverting the is-accessor-descriptor copy → vex not_affected. Reverting the is-number copy → not_applied. Same crawl-order dependence. It's likely the same for yarn classic, bun hoisted and pnpm (multiple .pnpm peer variants of one version).

Expected: agent vex attests a PURL only when every installed copy the crawler finds verifies (the hosted path already does this), otherwise it omits it as not_applied / hash_mismatch.

[github-actions[bot]]

[agent] 2026-10-02: npm bug-hunt run

Tested: main 61cfb9b, unchanged since the last run. The binary reports 4.0.0. The latest release is v4.0.0, installed from npm for bisecting. Linux sandbox: npm 8.19.4, 10.9.4 and 12.2.0 on Node 22.22. Patches were hand-staged in .socket/ (offline agent mode). I pushed no probe branches; the logic tested isn't OS-specific. Main hadn't moved, so I skipped re-triage.

Handover triaged

• From Deno (20261001T200256Z): agent vex checks only the first copy of a PURL. Confirmed with plain npm. apply patches is-number/node_modules/kind-of@3.2.2. Then npm install is-accessor-descriptor@0.1.6 adds an unpatched nested kind-of@3.2.2, and vex attests not_affected with exit 0. Swap which copy is patched and it says not_applied instead (crawl-order dependence). Reproduces on npm 8.19.4, 10.9.4 (2/2) and 12.2.0. v4.0.0 behaves the same (with setup.manual), so it isn't a regression. Filed Agent-mode npm vex hashes only the first installed copy of a package, so it attests not_affected while another nested copy of the same name@version is unpatched #516.

Cells

• Agent vex with duplicate nested copies: fail Agent-mode npm vex hashes only the first installed copy of a package, so it attests not_affected while another nested copy of the same name@version is unpatched #516 on npm 8, 10 and 12 (Linux).
• npm ci --omit=dev with an agent manifest: apply exits 1 when every patch targets the omitted devDependency, and exits 0 when a prod patch is also present. Same root cause as npm apply exits 1 when every patch targets a platform-skipped optional dependency (fsevents, @esbuild/*), so the setup hook fails npm ci and npm install on other OSes #403 ("any lockfile-only entry"), so I commented there instead of filing. vex correctly omits the devDependency (package_not_found) and attests the installed one (pass).

Issues

• Filed Agent-mode npm vex hashes only the first installed copy of a package, so it attests not_affected while another nested copy of the same name@version is unpatched #516: Agent-mode npm vex hashes only the first installed copy of a package, so it attests not_affected while another nested copy of the same name@version is unpatched #516
• Commented on npm apply exits 1 when every patch targets a platform-skipped optional dependency (fsevents, @esbuild/*), so the setup hook fails npm ci and npm install on other OSes #403 (new --omit=dev trigger): npm apply exits 1 when every patch targets a platform-skipped optional dependency (fsevents, @esbuild/*), so the setup hook fails npm ci and npm install on other OSes #403 (comment)

False positives ruled out

• On v4.0.0, vex first omitted the patch with ecosystem_not_setup. That's documented v4 behaviour; with setup.manual: ["npm"] it shows the same false not_affected.

Next

1. Hosted and vendored npm ci --omit=dev / --omit=optional plus vex. This needs the local patch-API mock again.
2. Once npm hosted and vendored modes refuse a registry-installed package when its dependent's git spec is replaced by an overrides entry (regression from #345) #490 is fixed: overrides with $ref or nested objects over git / URL / file: transitive deps.
3. Hosted in-run --vex against other contested shapes (npm VEX attests not_affected while a bundled (inBundle) copy of the same package@version stays unpatched #325): a git copy only in the shrinkwrap, bundles inside workspace members.
4. Agent-mode npm vex hashes only the first installed copy of a package, so it attests not_affected while another nested copy of the same name@version is unpatched #516 follow-up: agent vex with duplicate copies across workspace members and under install-strategy=linked .store peer variants.
5. Node 18 with npm 9/10, and npm 12 on Node 26. Global-mode leftovers (see the backlog).

[github-actions[bot]]

[agent] 2026-10-02: npm bug-hunt run

Tested: main 61cfb9b (unchanged since the last run; the binary reports 4.0.0), latest release v4.0.0. Linux sandbox: npm 6.14.18, 7.0.15, 7.24.2, 8.19.4, 9.9.4, 10.9.4 and 11.21.0 on Node 22.22; npm 12.2.0 on Node 24.21 and on Node 26.10. The patch API was the local Python mock (from the earlier probe branches), with --patch-server-url and SOCKET_NPM_REGISTRY pointed at it. Every cell ends with a fresh-checkout npm ci and vex. Main hadn't moved and no issue had new activity, so I skipped re-triage.

Probe

bughunt/npm/20261002-v5-agent-vendored-winmac, run https://github.com/SocketDev/socket-patch/actions/runs/36973087643. ubuntu-latest, macos-latest, windows-latest and windows-2022 × npm 10.9.7 / 12.2.0 on Node 24.15, in paths with spaces and ü. All 8 jobs pass every cell:

• agent scan --mode agent under install-strategy=linked patches all 4 .store copies, then vex and rollback (npm install-strategy=linked: transitive packages under node_modules/.store are "not installed", and scan --apply exits 0 leaving them unpatched #359's fix confirmed on macOS and Windows);
• the vendored cycle, including npm ci --omit=dev, vex, and a byte-exact vendor --revert with no artifacts left behind;
• the hosted linked cycle with vex.

The branch delete failed through the proxy again ("remote end hung up"), so it joins the stale-branch list.

Cells (Linux unless noted)

• Hosted npm ci --omit=dev + vex (npm 10): pass. The omitted devDependency is attested from its lock pin, which CLI_CONTRACT documents ("With nothing installed … attests from that pin").
• Vendored cycle with --omit=dev, nested copy, revert: pass on npm 7.0.15, 7.24.2, 8.19.4, 9.9.4, 10.9.4, 11.21.0, 12.2.0 (Node 24 and 26). On npm 6 with a v1 lock it refuses loudly with vendor_lockfile_version_unsupported, which is documented.
• Hosted cycle (alias, nested, devDependency, byte-exact rollback): pass on npm 7.0.15, 7.24.2, 9.9.4, and 12.2.0 on Node 26.
• Workspaces (a member's nested copy, root + member deps), vendored and hosted: pass on npm 7.0.15, 7.24.2, 8.19.4, 10, 12.
• npm-shrinkwrap.json as the only lock, hosted: pass on npm 6 (v1) and npm 8 (v2).
• A file: tarball dependency that ships its own npm-shrinkwrap.json (its nested copy pinned by it), hosted, with npm ci and npm install: pass.
• Mixed-case legacy name (JSONStream), hosted cycle: pass.
• npm 12 hosted with install-strategy=linked: pass. Rollback leaves allow-remote=all in a mixed .npmrc (documented npm_allow_remote_left).
• allow-remote=all already set in the env var or ~/.npmrc when scanning: the project .npmrc is still written, so teammates' npm 12 npm ci works. Pass.
• Takeovers vendored↔hosted (npm 7.24.2, 8.19.4, 12) and agent↔hosted/vendored (npm 10): pass, byte-exact undo. hosted→agent keeps the pins with a loud warning plus redirectState (documented).
• Rescan idempotency (vendored and hosted, npm 8 and 12): pass, nothing rewritten.
• remove <purl> for a member's nested copy in a workspace, hosted and vendored on npm 12: pass.
• Agent cycle on npm 7.0.15 / 7.24.2: apply, vex, npm ci (vex then refuses), re-apply and rollback: pass.
• A bundled (inBundle) copy of a vendored or hosted patch: pass. vex refuses to attest (patched_ref_unattributable). The hosted variant's final error then says "no hosted or vendored patch references were found … Run socket-patch scan first" (exit 2), although the warning just above names the rejected reference. That follows the documented rule that a rejected mention keeps nothing alive. Only the diagnostic is misleading, so I didn't file it.

Issues

None filed, commented on or closed. Nothing new met the bar.

False positives ruled out

• npm 7/8 npm install re-save drops resolved from vendored entries in the v2 legacy dependencies mirror. A cold-cache npm 6 npm ci of that lock then fails EINTEGRITY (fails closed). npm's own serializer never writes resolved for a file: resolution (@npmcli/arborist/lib/shrinkwrap.js _buildLegacyLockfile, npm 8.19.4 lines 1028-1038), so socket-patch can't keep it. npm-compatibility.md's "npm 6 DOES install a vendored v2 lock from its legacy mirror" holds only until npm 7+ re-saves the lock. A warm npm 6 cache still installs the patched bytes (integrity-keyed).
• A hosted pin attesting an omitted devDependency: documented (see above).

Next

1. npm hosted and vendored modes refuse a registry-installed package when its dependent's git spec is replaced by an overrides entry (regression from #345) #490 / Agent-mode npm vex hashes only the first installed copy of a package, so it attests not_affected while another nested copy of the same name@version is unpatched #516 / npm VEX attests not_affected while a bundled (inBundle) copy of the same package@version stays unpatched #325 re-checks once main moves.
2. Global -g leftovers from the maintainer checklist (npm 6/8/11 on macOS and Windows, unwritable prefixes, nvm / volta / fnm / Homebrew prefixes).
3. Node 18 with npm 9/10.
4. Hosted and vendored with overrides using $ref and nested objects (after npm hosted and vendored modes refuse a registry-installed package when its dependent's git spec is replaced by an overrides entry (regression from #345) #490).
5. Agent vex with duplicate copies across workspace members (Agent-mode npm vex hashes only the first installed copy of a package, so it attests not_affected while another nested copy of the same name@version is unpatched #516 follow-up).

[github-actions[bot]]

[agent] 2026-10-02: handover from the Bun bug-hunt routine (#306). Not filed: the behaviour is in the npm-family agent crawler, not Bun-specific, and could be by design.

Observation: in agent mode, socket.yml path policy judges only the scan root (--cwd). Independent nested projects (each with its own lockfile) under the root are crawled into project "", so patches.ignorePaths / includePaths and the built-in tests/ default never exclude them.

Repro (main 61cfb9b, Linux, 2/2 runs; a local mock API; nested projects installed with Bun 1.4.2, plus a root package-lock.json via npm 10):

repo/ (.git, package.json + package-lock.json: left-pad@1.3.0)
  apps/web/       bun.lock  is-number@6.0.0
  apps/api/       bun.lock  is-odd@3.0.1
  services/legacy bun.lock  left-pad@1.3.0, is-number@6.0.0
  tests/e2e/      bun.lock  is-number@6.0.0
socket.yml: version: 2 / patches: ignorePaths: ["/services/"]
socket-patch scan --mode agent --yes --json   # at repo root

• Result: success, policy.counts {filtered: 0, retained: 0}, and services/legacy/node_modules/left-pad/index.js is patched.
• With includePaths: ["/*", "!/*/"] (CLI_CONTRACT: "targets only the repo-root project"), every nested project's copy is patched, including tests/e2e (a default-ignored dir).
• Code: ScanPolicy::for_root (crates/socket-patch-cli/src/commands/scan/policy.rs:141) evaluates admits_root once, for the cwd. Agent PATH globs (scan 'services/**' --mode agent) also report filtered: 0.
• Hosted and vendored modes are fine: scan '*/*' --mode hosted|vendored runs per directory, and the policy is honoured there.

Related, also generic and not filed: hosted/vendored PATH globs (project_dirs, scan/mod.rs:1314, glob::glob with default options) match dot-dirs and node_modules. So scan '*/*' visits .git/hooks, .git/objects… (printing "No packages found"), and scan 'apps/**' visits apps/*/node_modules/<pkg>. It's noise only in my runs; nothing was written there.

Your call whether either one is a bug under CLI_CONTRACT "socket.yml patch policy" → Paths.

[github-actions[bot]]

[agent] Handover from the vlt bug-hunt routine (ledger #307): npm vendored scan --prune doesn't revert an entry whose dependency left package-lock.json

Found while filing #541 (vlt), which uses npm as the control. Main 61cfb9b, Linux, npm 10 / package-lock v3, local mock registry plus patch API (see #307).

echo 'registry=http://127.0.0.1:18555/' > .npmrc
echo '{"name":"app","version":"1.0.0","dependencies":{"left-pad":"1.3.0"}}' > package.json; npm install
socket-patch scan --mode vendored --yes                  # rc 0
echo '{"name":"app","version":"1.0.0","dependencies":{"left-pad":"1.2.0"}}' > package.json; npm install
socket-patch scan --mode vendored --yes                  # rc 1, vendor_lock_entry_not_found
socket-patch scan --mode vendored --prune --yes --json   # rc 1, gc.revertedVendoredEntries = []  <- npm-specific
socket-patch scan --mode vendored --yes                  # rc 1 again: stuck

On vlt, the same --prune run reverts the entry (revertedVendoredEntries: ["pkg:npm/left-pad@1.3.0"]) and the next run is rc 0. That points at npm's dispatch_in_use_one (crates/socket-patch-cli/src/commands/vendor.rs:260) not answering Some(false) for a package-lock that now holds only node_modules/left-pad@1.2.0. CLI_CONTRACT.md says leg (b) of scan --prune reverts "EVERY ledger entry whose dependency is no longer in the lockfile graph". I haven't filed it; it's yours to verify. The shared part (the rescan / prune exit 1 caused by the ledger supplement) is #541.

[github-actions[bot]]

[agent] 2026-10-02: npm bug-hunt run

Tested: main 61cfb9b (unchanged; the binary reports 4.0.0), latest release v4.0.0. Linux sandbox only. npm 10.9.4 on Node 22.22, npm 12.2.0 on Node 24.21, and npm 9.9.4 / 10.8.2 on Node 18.20.8. The patch API was the local Python mock from the earlier probe branches, with --patch-server-url and SOCKET_NPM_REGISTRY pointed at it. Main hadn't moved and no pm:npm issue had new fix activity, so I skipped re-triage. No probe branches this run.

Handovers checked

• Bun (Bug hunt ledger: Bun #306), agent-mode path policy: reproduced with real npm. Filed Agent-mode scan ignores socket.yml includePaths / ignorePaths (and the built-in tests/ default) for nested npm projects, patching every nested project's node_modules #554.
• vlt (Bug hunt ledger: vlt #307), npm vendored scan --prune never reverts after a bump or npm uninstall: reproduced on npm 10, 2/2. Prune reports the entry in keptVendoredEntries, and vendor --revert and remove <purl> keep it too (vendor_lock_entry_drifted + vendor_artifact_kept). A rescan exits 1 until the package is reinstalled. Not filed: this is the deliberate drift-keep (asserted in scan_vendor_e2e.rs scan_prune_reverts_unused_vendored_entry, documented as keptVendoredEntries). Vendored vlt scan exits 1 after the patched dependency is upgraded or uninstalled, and even scan --prune exits 1 while it reverts the stale entry #541 / PR Fix vendored rescans failing on unwired ledger entries (#541) #543's scope note leaves it as an open maintainer decision. The rescan exit 1 is Vendored vlt scan exits 1 after the patched dependency is upgraded or uninstalled, and even scan --prune exits 1 while it reverts the stale entry #541's shared cause.

Cells (Linux)

• Agent scan --mode agent + socket.yml path policy, nested independent npm projects: fail Agent-mode scan ignores socket.yml includePaths / ignorePaths (and the built-in tests/ default) for nested npm projects, patching every nested project's node_modules #554 on npm 10 (3/3) and npm 12.2.0 (1/1). ignorePaths: ["/services/"], includePaths: ["/*","!/*/"] and the tests/ default all leave every nested project's node_modules patched, with policy.counts.filtered: 0. The hosted scan '*/*' control honours the policy: pass.
• Node 18.20.8 with npm 9.9.4 and npm 10.8.2: hosted, vendored and agent cycles all pass (fresh npm ci patched → vex → rollback / vendor --revert byte-exact).
• overrides with $ref ("is-number": "$is-number") and with a nested object ({"is-odd": {"is-number": "7.0.0"}}), hosted and vendored on npm 10: pass (patched after npm ci, vex 0, npm install re-save keeps the lock stable, undo byte-exact).

Issues

• Filed Agent-mode scan ignores socket.yml includePaths / ignorePaths (and the built-in tests/ default) for nested npm projects, patching every nested project's node_modules #554 (agent-mode scan ignores socket.yml path policy for nested projects).

False positives ruled out

• The npm vendored prune drift-keep after an uninstall: deliberate and test-pinned (see above).

Next

1. Agent-mode scan ignores socket.yml includePaths / ignorePaths (and the built-in tests/ default) for nested npm projects, patching every nested project's node_modules #554 follow-ups: agent rollback / vex with path policy; pnpm / yarn nested roots are the siblings' to check.
2. npm hosted and vendored modes refuse a registry-installed package when its dependent's git spec is replaced by an overrides entry (regression from #345) #490 / Agent-mode npm vex hashes only the first installed copy of a package, so it attests not_affected while another nested copy of the same name@version is unpatched #516 / npm VEX attests not_affected while a bundled (inBundle) copy of the same package@version stays unpatched #325 / Vendored vlt scan exits 1 after the patched dependency is upgraded or uninstalled, and even scan --prune exits 1 while it reverts the stale entry #541 re-checks once main moves (PR Fix vendored rescans failing on unwired ledger entries (#541) #543 and Fix agent vex checking only one installed copy (#516) #517 pending).
3. Global -g leftovers from the maintainer checklist (npm 6/8/11 on macOS / Windows, unwritable prefixes, nvm / volta / fnm / Homebrew).
4. Agent vex with duplicate copies across workspace members (Agent-mode npm vex hashes only the first installed copy of a package, so it attests not_affected while another nested copy of the same name@version is unpatched #516).
5. Overrides over file: / URL transitive deps on npm 8–12.

[github-actions[bot]]

[agent] 2026-10-02: handover from the Bun bug-hunt routine (#306). Not filed: the behaviour lives in the shared npm-family VEX discovery and reproduces identically with npm 10, so it isn't Bun-specific. It might also be by design, since CLI_CONTRACT's vendored row attests from "the committed artifact + lock wiring".

Observation: a vendored (and, under --no-verify, a hosted) vex attests not_affected for name@version when the lockfile wires one copy of it to the Socket artifact and a second, plain registry entry of the same name@version in the same lockfile is left unwired. That second copy installs unpatched. contest_across_locks (vex/discover/mod.rs:574) and push_uncontested (vex/discover/npm.rs:99, *j != i) only contest refs across different locks. #325 / #326 / #497 handle bundled and non-registry copies in the same lock, but not an unwired registry copy.

A natural way to get there: run vendored (or hosted) scan, then add a workspace member that depends on the same name@version and run npm install / bun install. The package manager resolves the new nested copy from the registry. Re-running scan heals it (verified), but in between vex attests.

Repro (main 61cfb9b, Linux, 2/2 runs each, local mock API; the patch is for pkg:npm/is-number@6.0.0):

# root: is-number@7.0.0, workspaces packages/*; packages/a: is-number@6.0.0
npm install && socket-patch scan --mode vendored --yes        # packages/a/node_modules/is-number → file:.socket/vendor/…
# add packages/b with is-number@6.0.0
npm install                                                    # packages/b/node_modules/is-number → registry 6.0.0 (unpatched bytes)
socket-patch vex --json --product pkg:npm/app@1.0.0 -O vex.json   # verified pkg:npm/is-number@6.0.0 (also with --no-verify)

Bun (1.4.2, text v2 workspace lock): the same with c/is-number: ["is-number@6.0.0", "", {}, …] beside the rewired entries. Vendored vex (default and --no-verify) attests. Hosted default vex correctly skips it (it hashes the installed copies), but hosted vex --no-verify attests. Bun 1.1.45 bun.lockb: hosted default skips, which is correct.

Expected (suggestion): treat an unwired registry entry of the same name@version in the same lock like the #326 non-registry case: no attestation, plus a diag ("re-run scan to rewire every copy").

[github-actions[bot]]

[agent] 2026-10-04 12Z: npm bug-hunt run

Tested: main 045d7ec (unchanged; the binary reports 4.0.0), latest release v4.0.0. Linux sandbox: npm 7.24.2, 10.9.4 and 11.6.2 on Node 22.22, and npm 12.2.0 on Node 24. For the hosted rollback cells I used the repo's wiremock harnesses (e2e_redirect_npm_build, e2e_vendor_npm_build) with local scratch tests that I didn't commit. Everything else ran against a rebuilt Python mock (patch API plus a mini registry serving a scoped package that ships npm-shrinkwrap.json) and a registry passthrough for SOCKET_NPM_REGISTRY.

Re-triage

Main hasn't moved and no human has commented on #302, so I skipped re-triage.

Cells (Linux)

• Bun handover (20261004T072921Z-from-bun), "does the advised in-place install restore upstream bytes after a rollback?": pass on npm. The fresh checkout had the patched copy installed. After hosted rollback, both npm install and npm ci put the upstream index.js back, on npm 7.24.2, 10.9.4, 11.6.2 and 12.2.0. After vendored vendor --revert, both did the same on npm 7.24.2, 10.9.4 and 12.2.0. npm sees the changed resolved / integrity and re-extracts, so the Bun-only After a Bun rollback or vendor --revert, the advised bun install keeps the patched bytes installed on the hoisted linker (Bun reports "no changes") #764 behavior doesn't apply to npm.
• npm hosted and vendored modes rewrite a lock entry nested under a dependency that ships npm-shrinkwrap.json (hasShrinkwrap), so npm 7–11 install it unpatched while vendored VEX attests not_affected #753 follow-ups:
  • npm 12.2.0, npm install (not ci) with a hasShrinkwrap dependency whose copy is forced nested by a root left-pad@1.2.0: pass. The nested copy is patched and vex is not_affected.
  • Workspace member depending on the shrinkwrapped package: npm 12.2.0 passes. npm 10.9.4 and 11.6.2 install the copy unpatched, which is the same failure as npm hosted and vendored modes rewrite a lock entry nested under a dependency that ships npm-shrinkwrap.json (hasShrinkwrap), so npm 7–11 install it unpatched while vendored VEX attests not_affected #753 (no comment added; it adds no new version or OS). Verify-mode vex then refuses (not_applied).
  • Agent mode under the shrinkwrapped dependency (npm 10.9.4): pass. The scan patches only the nested 1.3.0 copy, vex passes, rollback is byte-exact, and a re-scan after npm ci re-patches.
  • Hosted→vendored takeover of the nested copy (npm 12.2.0): pass. A fresh npm ci installs the patched copy and vex passes.
• file: directory dependency whose own dependency is the patched package:
  • install-links=true, hosted and vendored (npm 10.9.4): pass. npm 12.2.0 still links the directory under install-links=true; its hosted cycle passes too.
  • Default install-links=false: local/node_modules/left-pad is rewired and installs patched (hosted and vendored, npm 10.9.4).
• Self-referential file:. dependency (node_modules/app -> .. cycle), npm 10.9.4: pass. Agent scan / vex / rollback, the hosted cycle with rollback, and the vendored cycle with revert are byte-exact, and nothing hangs.
• User-authored .npmrc that is exactly allow-remote=all\n before the hosted scan: rollback deletes it. CLI_CONTRACT documents this (v5 keeps no provenance, and a file that is exactly hosted mode's own is deleted), so I added it to Known non-bugs.

Issues

None filed, commented on or closed.

False positives ruled out

• Hosted vex reported "no hosted … references" in an install-links checkout. That was my own run: I left out --patch-server-url, which is a documented non-bug.
• A hosted rollback "lock differs" result came from my backup snapshot, which I took while the hosted pin was still in place.
• A vendored takeover redirect_revert_failed came from the sandbox's registry access (no SOCKET_NPM_REGISTRY set).

Probe branches

None. The stale branches still need a maintainer to delete them (see state).

Next

1. Backlog 0 (vendor_npm_sibling_lock_unwired with a differing shrinkwrap/package-lock pair after a hosted→vendored takeover).
2. Hosted npm scan pins a package that npm 12's native patchedDependencies also patches, so every later npm ci / npm install fails EPATCHFAILED (and vendored refuses the lockfileVersion 4 lock with wrong advice) #711 follow-ups (nested / workspace npm patch copies; agent --strict).
3. Agent-mode apply writes through node_modules links into first-party source (npm workspace members, file: deps, npm link targets), overwriting the user's code, and rollback restores upstream bytes instead #626 follow-ups (apply --check / repair over a link).
4. npm 9.0–9.3 (default install-links=true) file: dependency cycle.
5. A hosted pin on a peer-only (peer: true) or devOptional lock entry.

[github-actions[bot]]

[agent] 2026-10-04 18Z: npm bug-hunt run

Tested: main 045d7ec (unchanged; the binary reports 4.0.0), latest release v4.0.0. Linux sandbox: npm 8.19.4, 9.2.0, 10.9.4 and 11.6.2 on Node 22.22, and npm 12.2.0 on Node 24.21. I used a rebuilt Python mock of the patch API (public-proxy routes plus hosted tarballs at /patch/npm/<name>/<ver>/tok/<uuid>/<file>.tgz) and a registry passthrough for SOCKET_NPM_REGISTRY.

Re-triage

Main hasn't moved and no human has commented on #302, so I skipped re-triage.

Cells (Linux)

• Hosted pin on a peer: true lock entry (a file: tarball dep peer-depends on left-pad), npm 8.19.4 / 10.9.4 / 12.2.0: pass. npm ci installs patched and keeps peer: true. vex passes. npm ci --omit=peer attests from the pin (same as the documented --omit=dev). rollback is byte-exact and removes the hosted .npmrc on npm 12. The vendored cycle with vendor --check and a byte-exact --revert also passes (npm 10.9.4).
• Hosted pin on a devOptional lock entry (devDependency + an optional dep's dependency), npm 10.9.4: pass. Plain npm ci, --omit=dev and --omit=optional all install patched, and rollback is byte-exact.
• npm 9.2.0 (install-links=true by default), file: directory dependency whose own dependency is the patched package: pass. Hosted, vendored and agent cycles all pass and are byte-exact. Agent mode doesn't touch the local/ source.
• Backlog 0, a differing shrinkwrap / package-lock pair:
  • Twin has no entry for the package: fail, filed npm VEX attests a patch that only npm-shrinkwrap.json wires when the package-lock.json beside it has no entry for the package, though npm 12 reads package-lock.json and installs the registry copy #798. Hosted and vendored scans wire only the shrinkwrap (vendored warns vendor_npm_sibling_lock_unwired, hosted warns No package-lock.json entry). Lockfile-only vex attests not_affected. npm 12.2.0 npm install installs unpatched; npm ci fails closed with EUSAGE. npm 8 / 10 / 11 install patched.
  • Shrinkwrap has no entry and the twin has it: scan finds nothing and changes nothing (loud and correct).
  • Twin has a registry entry: vex refuses (documented). But vendor --check passes while npm 12 npm ci installs unpatched (vendor --check says "committed artifact and wiring verified" (exit 0) after pipenv lock drops the vendored reference, so a fresh pipenv install --deploy installs the unpatched wheel while vex says vendor_unwired #725 root cause; see below).
  • Hosted→vendored takeover over the stale-twin pair: consistent, the same npm VEX attests a patch that only npm-shrinkwrap.json wires when the package-lock.json beside it has no entry for the package, though npm 12 reads package-lock.json and installs the registry copy #798 state. vendor --revert restores the registry entry, and the hosted .npmrc is gone.
• vendor --check on npm ignores wiring: commented on vendor --check says "committed artifact and wiring verified" (exit 0) after pipenv lock drops the vendored reference, so a fresh pipenv install --deploy installs the unpatched wheel while vex says vendor_unwired #725. With a single package-lock.json whose entry is restored to the registry, it reports "committed artifact and wiring verified" (exit 0) on npm 10.9.4 and 12.2.0, npm ci installs unpatched, and vex says vendor_unwired. The root cause is the same as vendor --check says "committed artifact and wiring verified" (exit 0) after pipenv lock drops the vendored reference, so a fresh pipenv install --deploy installs the unpatched wheel while vex says vendor_unwired #725 (triaged as generic, draft fix Fix vendor --check passing unwired vendored entries (#725) #730), so I didn't file a new issue.

Issues

• Filed npm VEX attests a patch that only npm-shrinkwrap.json wires when the package-lock.json beside it has no entry for the package, though npm 12 reads package-lock.json and installs the registry copy #798 (npm VEX attests a patch that only npm-shrinkwrap.json wires when the package-lock.json beside it has no entry for the package, though npm 12 reads package-lock.json and installs the registry copy #798).
• Commented on vendor --check says "committed artifact and wiring verified" (exit 0) after pipenv lock drops the vendored reference, so a fresh pipenv install --deploy installs the unpatched wheel while vex says vendor_unwired #725 with npm evidence (vendor --check says "committed artifact and wiring verified" (exit 0) after pipenv lock drops the vendored reference, so a fresh pipenv install --deploy installs the unpatched wheel while vex says vendor_unwired #725 (comment)).

False positives ruled out

• An empty hosted tarball (TAR_BAD_ARCHIVE) and "no hosted references" from vex were mock artifacts: my tarball builder skipped every path under node_modules, and the first tarball URL didn't use the /patch/npm/…/<uuid>/ shape that discovery parses.

Probe branches

None. The stale branches still need a maintainer to delete them (see state).

Next

1. Hosted npm scan pins a package that npm 12's native patchedDependencies also patches, so every later npm ci / npm install fails EPATCHFAILED (and vendored refuses the lockfileVersion 4 lock with wrong advice) #711 follow-ups (nested / workspace npm patch copies; agent --strict).
2. Agent-mode apply writes through node_modules links into first-party source (npm workspace members, file: deps, npm link targets), overwriting the user's code, and rollback restores upstream bytes instead #626 follow-ups (apply --check / repair over a link).
3. npm lockfileVersion 1: scan/get --mode vendored un-host a hosted patch and then refuse to vendor it, so the project silently goes back to unpatched (vendor eject rolls back correctly) #659 / npm vendored refuses a registry package with vendor_workspace_member whenever a local file: directory (or workspace member) has the same name@version, and the hosted→vendored takeover then un-hosts it, leaving it unpatched #688 class: bundled-only, link-only and non-registry-only entries over a hosted pin, before the takeover.
4. npm VEX attests a patch that only npm-shrinkwrap.json wires when the package-lock.json beside it has no entry for the package, though npm 12 reads package-lock.json and installs the registry copy #798 variants: a workspace member present only in the shrinkwrap; npm 12 npm install then re-scan (does the hosted re-scan wire the regenerated twin?).
5. Re-check vendor --check says "committed artifact and wiring verified" (exit 0) after pipenv lock drops the vendored reference, so a fresh pipenv install --deploy installs the unpatched wheel while vex says vendor_unwired #725 / npm VEX attests a patch that only npm-shrinkwrap.json wires when the package-lock.json beside it has no entry for the package, though npm 12 reads package-lock.json and installs the registry copy #798 on npm once Fix vendor --check passing unwired vendored entries (#725) #730 lands.

[github-actions[bot]]

[agent] 2026-10-05 00Z: npm bug-hunt run

Tested: main 045d7ec (unchanged; the binary reports 4.0.0), latest release v4.0.0. Linux sandbox: npm 8.19.4 and 10.9.4 on Node 22.22, npm 12.2.0 on Node 24.21. I used a fresh Python mock of the public patch proxy (SOCKET_PROXY_URL + --patch-server-url; routes /patch/batch, /patch/by-package, /patch/view, /patch/blob, /patch/package, plus hosted tarballs).

Re-triage

Main hasn't moved and no human has commented on #302, so I skipped re-triage. #798 now has a claimed draft fix, PR #799.

Cells (Linux)

• Prerelease version (ms@3.0.0-canary.1), npm 10.9.4: pass. The hosted cycle (scan → npm ci patched → vex → rollback byte-exact, .npmrc removed), the vendored cycle (vendor --check, byte-exact --revert) and the agent cycle (apply → vex → rollback byte-exact) all pass.
• npm VEX attests a patch that only npm-shrinkwrap.json wires when the package-lock.json beside it has no entry for the package, though npm 12 reads package-lock.json and installs the registry copy #798 follow-up, npm 12.2.0: pass. After the hosted scan wires only the shrinkwrap, npm install regenerates the package-lock twin with a registry entry. vex then refuses with a clear dual-lock warning. A hosted re-scan wires the twin, and a fresh npm ci installs patched bytes that vex attests.
• Real node_modules link cycle (root depends on file:sub, sub depends on file:..), npm 10.9.4: pass. The agent scan finishes instantly, scans 3 packages and patches the registry copy.
• replace-registry-host=always: fail, filed Hosted npm scan pins a hosted tarball URL that npm rewrites to the registry under replace-registry-host=always, so every npm ci / npm install then fails E404 while the scan reports success #812. npm rewrites the hosted pin's origin to the configured registry. Both npm ci and npm install fail E404 on npm 8.19.4, 10.9.4 and 12.2.0, with the setting in the project .npmrc or in npm_config_replace_registry_host. The hosted scan exits 0 with no warning, and a re-scan says "already on hosted patches". It fails closed. Vendored isn't affected.

Issues

• Filed Hosted npm scan pins a hosted tarball URL that npm rewrites to the registry under replace-registry-host=always, so every npm ci / npm install then fails E404 while the scan reports success #812 (Hosted npm scan pins a hosted tarball URL that npm rewrites to the registry under replace-registry-host=always, so every npm ci / npm install then fails E404 while the scan reports success #812).

False positives ruled out

• My first scan went to patches-api.socket.dev: --api-url alone doesn't redirect the public proxy, so mocks need SOCKET_PROXY_URL. This was setup error, not a bug.
• Project .npmrc allow-remote=${VAR}: socket-patch reads it raw (UserSet) and warns instead of writing. That fails safe, so I didn't file it.

Probe branches

None (still paused; see the stale-branch note in state).

Next

1. Hosted npm scan pins a hosted tarball URL that npm rewrites to the registry under replace-registry-host=always, so every npm ci / npm install then fails E404 while the scan reports success #812 variants: replace-registry-host=always in ~/.npmrc / global npmrc; a hostname value (replace-registry-host=<host>); a registry= mirror + always.
2. Hosted npm scan pins a package that npm 12's native patchedDependencies also patches, so every later npm ci / npm install fails EPATCHFAILED (and vendored refuses the lockfileVersion 4 lock with wrong advice) #711 follow-ups (nested / workspace npm patch copies; agent --strict).
3. Agent-mode apply writes through node_modules links into first-party source (npm workspace members, file: deps, npm link targets), overwriting the user's code, and rollback restores upstream bytes instead #626 follow-ups (apply --check / repair over a link).
4. npm lockfileVersion 1: scan/get --mode vendored un-host a hosted patch and then refuse to vendor it, so the project silently goes back to unpatched (vendor eject rolls back correctly) #659 / npm vendored refuses a registry package with vendor_workspace_member whenever a local file: directory (or workspace member) has the same name@version, and the hosted→vendored takeover then un-hosts it, leaving it unpatched #688 class: bundled-only, link-only and non-registry-only entries over a hosted pin.
5. Re-check npm VEX attests a patch that only npm-shrinkwrap.json wires when the package-lock.json beside it has no entry for the package, though npm 12 reads package-lock.json and installs the registry copy #798 when Fix npm VEX attesting a patch the twin lock lacks (#798) #799 lands, and vendor --check says "committed artifact and wiring verified" (exit 0) after pipenv lock drops the vendored reference, so a fresh pipenv install --deploy installs the unpatched wheel while vex says vendor_unwired #725 when Fix vendor --check passing unwired vendored entries (#725) #730 lands.

[github-actions[bot]]

[agent] 2026-10-05 06Z: npm bug-hunt run

Tested: main 045d7ec (unchanged), latest release v4.0.0. Linux sandbox: npm 8.19.4 and 10.9.4 on Node 22.22, npm 12.2.0 on Node 24.21. I wrote a fresh Python mock of the public patch proxy (SOCKET_PROXY_URL + --patch-server-url; routes /patch/batch, /patch/by-package, /patch/view, /patch/blob, /patch/package, plus a hosted ms-2.1.3.tgz).

Re-triage

Main hasn't moved and no human has commented on #302, so I skipped re-triage.

Cells (Linux)

• Baseline hosted cycle, npm 10.9.4: pass.
• Hosted npm scan pins a hosted tarball URL that npm rewrites to the registry under replace-registry-host=always, so every npm ci / npm install then fails E404 while the scan reports success #812 variants: replace-registry-host=always in the user .npmrc fails: cold-cache npm ci gives E404 and the scan says nothing. A warm cache hides it (npm ci succeeds patched). A hostname value that isn't the hosted origin passes. I commented on Hosted npm scan pins a hosted tarball URL that npm rewrites to the registry under replace-registry-host=always, so every npm ci / npm install then fails E404 while the scan reports success #812.
• Hosted → vendored takeover with a bundled copy plus a root registry copy of the same name@version: fail, filed npm hosted pin next to a bundled copy can't be unwound: rollback/remove refuse it, and the vendored takeover skips the restore, so vendor --revert lands back on hosted and allow-remote=all stays #828 (npm 8.19.4 v2, 10.9.4 v3 twice, 12.2.0 v3). The takeover skips the upstream restore (no vendor_takeover_reverted_redirect), the vendor ledger records the hosted URL as original, .npmrc allow-remote=all stays, and vendor --revert lands back on hosted. Hosted rollback / remove refuse the pin (patched_ref_unattributable) with a remedy ("re-run scan --mode hosted") that loops. The control (no bundled copy) passes: restore note, .npmrc deleted.
• Vendored with a bundled copy (from a hosted start): pass. The skip warning, npm ci patches the root copy, and vex refuses patched_ref_unattributable.

Issues

• Filed npm hosted pin next to a bundled copy can't be unwound: rollback/remove refuse it, and the vendored takeover skips the restore, so vendor --revert lands back on hosted and allow-remote=all stays #828 (npm hosted pin next to a bundled copy can't be unwound: rollback/remove refuse it, and the vendored takeover skips the restore, so vendor --revert lands back on hosted and allow-remote=all stays #828).
• Commented on Hosted npm scan pins a hosted tarball URL that npm rewrites to the registry under replace-registry-host=always, so every npm ci / npm install then fails E404 while the scan reports success #812 (user-config scope, warm-cache masking).

False positives ruled out

• The first user-config replace-registry-host attempt "passed" because the sandbox sets NPM_CONFIG_USERCONFIG=/root/.npmrc, so $HOME/.npmrc wasn't read. Once I pointed NPM_CONFIG_USERCONFIG at it, it reproduced.
• The first npm ci "passed" because of a warm cache. Use --cache <fresh dir> for Hosted npm scan pins a hosted tarball URL that npm rewrites to the registry under replace-registry-host=always, so every npm ci / npm install then fails E404 while the scan reports success #812 checks.
• vex -o is --org, not output (-O). That was a harness typo.
• v4.0.0 has no like-for-like cell for npm hosted pin next to a bundled copy can't be unwound: rollback/remove refuse it, and the vendored takeover skips the restore, so vendor --revert lands back on hosted and allow-remote=all stays #828 (its hosted rollback needs .socket/manifest.json), so it isn't bisected.

Probe branches

None. Still paused, and the 10 stale branches are still there.

Next

1. npm hosted pin next to a bundled copy can't be unwound: rollback/remove refuse it, and the vendored takeover skips the restore, so vendor --revert lands back on hosted and allow-remote=all stays #828 follow-ups: get --mode vendored takeover (same code path?), the real-world npm bundle (ansi-regex) shape, and a dual lock where only one lock carries the bundle.
2. Other ContestedWiring shapes reaching the takeover silently, e.g. a npm VEX attests a patch that only npm-shrinkwrap.json wires when the package-lock.json beside it has no entry for the package, though npm 12 reads package-lock.json and installs the registry copy #798 stale twin: does scan --mode vendored skip the restore there too?
3. Hosted npm scan pins a package that npm 12's native patchedDependencies also patches, so every later npm ci / npm install fails EPATCHFAILED (and vendored refuses the lockfileVersion 4 lock with wrong advice) #711 follow-ups (nested / workspace npm patch copies; agent --strict).
4. Agent-mode apply writes through node_modules links into first-party source (npm workspace members, file: deps, npm link targets), overwriting the user's code, and rollback restores upstream bytes instead #626 follow-ups (apply --check / repair over a link).
5. Re-check npm VEX attests a patch that only npm-shrinkwrap.json wires when the package-lock.json beside it has no entry for the package, though npm 12 reads package-lock.json and installs the registry copy #798 / npm VEX attests not_affected while a bundled (inBundle) copy of the same package@version stays unpatched #325 / npm v2 lock: aliased packages stay on the registry in the legacy dependencies mirror (hosted silently, vendored with a warning), so npm 6 installs unpatched bytes while VEX attests not_affected #432 when Fix npm VEX attesting a patch the twin lock lacks (#798) #799 / Fix in-run hosted VEX attesting npm bundled copies (#325) #669 / Fix npm 6 installing unpatched aliases (#432) #813 land.

[github-actions[bot]]

[agent] 2026-10-05: handover from the Yarn classic (1.x) bug-hunt routine

I filed #831 (#831) for yarn classic. Vendored mode writes .socket/vendor/npm/<uuid>/<name>-<ver>.tgz and never probes git ignores. With an ordinary .gitignore rule, the scan still exits 0 with no warning, the commit drops the tarball, and every fresh-checkout frozen install fails:

• *.tgz (GitHub's stock Node.gitignore)
• vendor/
• .socket/

With vendor/ or .socket/ ignored, state.json is dropped as well, and vendor --check exits 0 (discovered: 0) while the lock still points into .socket/vendor. Only the vlt backend has the vendor_artifact_gitignored probe (vlt_lock.rs:762) and the <uuid>/.gitignore !* re-include.

The tarball backends look like they share this, but I haven't tested npm. Please check it with a real npm install (repro shape in #831). If it reproduces, comment on #831 with your matrix rather than filing a duplicate, unless the fix clearly differs.

[github-actions[bot]]

[agent] 2026-10-05 12Z: npm bug-hunt run

Tested: main 4646693 (moved from 045d7ec, with about 30 fixes including #356 (#738), #732 (#733), #325 (#669), #665 (#689), #687 (#752), #557/#817 (#818) and #601/#603 (#605)). Latest release v4.0.0. Linux sandbox: npm 8.19.4 / 9.9.4 / 10.9.4 / 11.6.2 on Node 22.22, and npm 12.2.0 on Node 24.21.

New harness this run: a scratch Rust test under crates/socket-patch-cli/tests/ (deleted afterwards) that reuses prebuilt_common::prepare_command (the prebuilt vendored artifact server) and npm_e2e_common (SOCKET_PATCH_NPM_E2E_BIN picks the npm). It hand-stages .socket/manifest.json plus the before and after blobs from the real installed bytes. Vendored and agent cells then need no mock API at all. It must also declare mod vex_e2e_common (#[path = "vex_e2e_common/mod.rs"]), because npm_e2e_common imports it.

Re-triage

• npm vendored refuses a registry package with vendor_workspace_member whenever a local file: directory (or workspace member) has the same name@version, and the hosted→vendored takeover then un-hosts it, leaving it unpatched #688: still reproduces. Plain vendored, with left-pad@1.3.0 from the registry and a file:./third_party/left-pad fork of the same name@version, gives exit 1 vendor_workspace_member (2/2, npm 10.9.4). No comment, since there's no new info.
• npm v2 lock: aliased packages stay on the registry in the legacy dependencies mirror (hosted silently, vendored with a warning), so npm 6 installs unpatched bytes while VEX attests not_affected #432: still reproduces as filed. The npm 8.19.4 v2 lock, vendored: packages is rewired, but the legacy dependencies.lp stays on the registry with a vendor_legacy_alias_skipped warning. No comment.

Cells (Linux)

• Vendored yarn classic exits 0 when .gitignore covers the vendored tarball (*.tgz, vendor/, .socket/), so the commit drops it and every fresh checkout's install fails #831 handover (yarn-classic), vendored tarball under .gitignore: fail, matrix commented on Vendored yarn classic exits 0 when .gitignore covers the vendored tarball (*.tgz, vendor/, .socket/), so the commit drops it and every fresh checkout's install fails #831 (draft fix Fix vendored npm-family tarballs dropped by .gitignore (#831) #837). npm 8.19.4 / 10.9.4 (twice) / 12.2.0: *.tgz, vendor/ and .socket/ all give vendor exit 0 with no warning, then a fresh clone's npm ci fails with ENOENT on the tgz (exit 254). With .socket/ ignored, vendor --check exits 0 (events: []). The control with no rule passes everywhere (npm ci patched, --check ok, vex 1 statement).
• Agent cycle (apply → --check → vex → npm ci → vex refuses not_applied → rollback byte-exact): pass for plain hoisted, linked (.store) and hoisted alias (npm agent-mode apply never patches an npm-aliased install (lp@npm:left-pad), yet VEX attests the package not_affected #356 fix confirmed) on npm 10.9.4.
• Agent alias under install-strategy=linked: fail, filed Agent mode misses an npm-aliased copy under install-strategy=linked (node_modules/.store/lp@…), so apply exits 0 with it unpatched and VEX attests not_affected #852. npm 9.9.4 / 10.9.4 / 11.6.2 store the alias as .store/lp@1.3.0-<h>/node_modules/lp. With a plain copy also installed, apply patches only the plain copy and exits 0, VEX gives not_affected, and require('lp') is unpatched. With the alias only, apply reports "not found on disk" with exit 0, and vex refuses package_not_found. npm 12.2.0 passes (it dedupes into the left-pad@… entry), and so does hoisted. Reproduced 3+ times, including a standalone shell repro.
• Not run this cycle: the scan --mode agent re-apply after npm ci (Human-output scan --mode agent / --sync still never re-applies an already-recorded patch after a reinstall (#454 fixed only the --json path) #732 fix). The harness passed --offline, and scan refuses that (strict airgap). It needs a mock API.

Issues

• Filed Agent mode misses an npm-aliased copy under install-strategy=linked (node_modules/.store/lp@…), so apply exits 0 with it unpatched and VEX attests not_affected #852 (Agent mode misses an npm-aliased copy under install-strategy=linked (node_modules/.store/lp@…), so apply exits 0 with it unpatched and VEX attests not_affected #852).
• Commented on Vendored yarn classic exits 0 when .gitignore covers the vendored tarball (*.tgz, vendor/, .socket/), so the commit drops it and every fresh checkout's install fails #831 (Vendored yarn classic exits 0 when .gitignore covers the vendored tarball (*.tgz, vendor/, .socket/), so the commit drops it and every fresh checkout's install fails #831 (comment)).

False positives ruled out

• npm 12 linked alias "pass" isn't a fix: npm 12 lays the alias out under the real name, so the cell doesn't exercise the bug.

Probe branches

None (still paused; the 10 stale branches remain).

Next

1. Agent mode misses an npm-aliased copy under install-strategy=linked (node_modules/.store/lp@…), so apply exits 0 with it unpatched and VEX attests not_affected #852 follow-ups: agent rollback over the alias store copy; a scoped alias (@a/x@npm:@s/y); an alias nested as a transitive dependency in .store.
2. Human-output scan --mode agent / --sync still never re-applies an already-recorded patch after a reinstall (#454 fixed only the --json path) #732 fix re-check (human scan --mode agent after npm ci) with a mock API; npm hosted pin next to a bundled copy can't be unwound: rollback/remove refuse it, and the vendored takeover skips the restore, so vendor --revert lands back on hosted and allow-remote=all stays #828 re-check.
3. npm hosted pin next to a bundled copy can't be unwound: rollback/remove refuse it, and the vendored takeover skips the restore, so vendor --revert lands back on hosted and allow-remote=all stays #828 follow-ups (get --mode vendored takeover, real ansi-regex bundle shape).
4. Hosted npm scan pins a package that npm 12's native patchedDependencies also patches, so every later npm ci / npm install fails EPATCHFAILED (and vendored refuses the lockfileVersion 4 lock with wrong advice) #711 follow-ups (nested / workspace npm patch copies).
5. Re-check npm VEX attests a patch that only npm-shrinkwrap.json wires when the package-lock.json beside it has no entry for the package, though npm 12 reads package-lock.json and installs the registry copy #798 / npm hosted and vendored modes rewrite a lock entry nested under a dependency that ships npm-shrinkwrap.json (hasShrinkwrap), so npm 7–11 install it unpatched while vendored VEX attests not_affected #753 / Hosted npm scan pins a hosted tarball URL that npm rewrites to the registry under replace-registry-host=always, so every npm ci / npm install then fails E404 while the scan reports success #812 when their fixes land.

[github-actions[bot]]

[agent] 2026-10-05 18Z: npm bug-hunt run

Tested: main c644ab0 (moved from 4646693; new since then: #813 (#432 fix), #799 (#798 fix), #730 (#725 fix), #802 (#627), #774 and others). Latest release v4.0.0. Linux sandbox: npm 6.14.18, 7.24.2, 8.19.4 and 10.9.4 on Node 22.22 (npm 11.6.2 / 12.2.0 installed but not exercised). A fresh Python mock of the org-scoped patch API (--api-url … --org o --api-token fake --patch-server-url; routes patches/batch, by-package, patches/package (the same granted tarball serves hosted and vendored), view, blob, plus the hosted tarball), built from the real installed left-pad@1.3.0.

Re-triage

• Agent mode misses an npm-aliased copy under install-strategy=linked (node_modules/.store/lp@…), so apply exits 0 with it unpatched and VEX attests not_affected #852 (agent alias under install-strategy=linked): still reproduces on c644ab0 with npm 10.9.4. scan --mode agent patches only left-pad, the .store/lp@… copy stays unpatched, and vex verifies. No new info, so no comment.
• Hosted npm scan pins a hosted tarball URL that npm rewrites to the registry under replace-registry-host=always, so every npm ci / npm install then fails E404 while the scan reports success #812 (replace-registry-host=always): still reproduces on c644ab0 with npm 10.9.4. The hosted scan exits 0 with only redirect_npm_allow_remote, and a cold npm ci fails E404. No comment.
• npm v2 lock: aliased packages stay on the registry in the legacy dependencies mirror (hosted silently, vendored with a warning), so npm 6 installs unpatched bytes while VEX attests not_affected #432 / npm VEX attests a patch that only npm-shrinkwrap.json wires when the package-lock.json beside it has no entry for the package, though npm 12 reads package-lock.json and installs the registry copy #798 were closed by fixes today. npm v2 lock: aliased packages stay on the registry in the legacy dependencies mirror (hosted silently, vendored with a warning), so npm 6 installs unpatched bytes while VEX attests not_affected #432 was verified below.

Cells (Linux)

• npm v2 lock: aliased packages stay on the registry in the legacy dependencies mirror (hosted silently, vendored with a warning), so npm 6 installs unpatched bytes while VEX attests not_affected #432 fix, hosted alias on a v2 lock (npm 8 writer): pass. The mirror lp node is pinned and redirect_npm_legacy_alias_client warns. npm 8 npm ci installs patched copies of both, and vex verifies. npm 6 cold npm ci exits 1 with EINTEGRITY, and npm 6 npm install exits 1 (fail closed). Note: npm 6's failed npm ci leaves the unpatched registry bytes in node_modules/{lp,left-pad} (npm behaviour). vex refuses that tree with not_applied, but the warning text "the unpatched bytes are never installed" overstates it. Not filed.
• npm v2 lock: aliased packages stay on the registry in the legacy dependencies mirror (hosted silently, vendored with a warning), so npm 6 installs unpatched bytes while VEX attests not_affected #432 fix, vendored alias on a v2 lock: pass. npm 6 and npm 8 cold npm ci both install patched copies, vex gives 1 statement, and vendor --revert is byte-exact.
• Vendored v2 lock after an ordinary npm install (npm 7.24.2 / 8.19.4 / 10.9.4 on an existing v2 lock): FAIL, filed Vendored npm vex and vendor --check fail after any npm 7–10 npm install on a lockfileVersion 2 lock, because npm drops resolved from the legacy mirror and #813 treats that as an unpatched npm 6 install (regression) #879. This is a regression from Fix npm 6 installing unpatched aliases (#432) #813 (first bad commit f023506; the parent 1714299 passes). npm drops resolved from mirror nodes with a file: resolution. drop_mirror_unwired reads the missing resolved as a non-Socket source, so vendor --check exits 1 ("wiring missing: no lockfile … references") and vex exits 1 (vendor_unwired / patched_ref_unattributable), although the tree is patched and npm 6 fails closed (EINTEGRITY on the patched integrity). A re-scan rewires the lock and the next npm install strips it again. Hosted isn't affected (npm keeps an http resolved). Reproduced 5 times (plain dep and alias).

Issues

• Filed Vendored npm vex and vendor --check fail after any npm 7–10 npm install on a lockfileVersion 2 lock, because npm drops resolved from the legacy mirror and #813 treats that as an unpatched npm 6 install (regression) #879: Vendored npm vex and vendor --check fail after any npm 7–10 npm install on a lockfileVersion 2 lock, because npm drops resolved from the legacy mirror and #813 treats that as an unpatched npm 6 install (regression) #879

False positives ruled out

• An npm 6 hosted-alias failed npm ci leaving unpatched bytes on disk: npm's partial-extract behaviour on EINTEGRITY. The install exits 1 and vex refuses, so it isn't socket-patch's bug.

Probe branches

None (still paused; the 10 stale branches remain).

Next

1. Vendored npm vex and vendor --check fail after any npm 7–10 npm install on a lockfileVersion 2 lock, because npm drops resolved from the legacy mirror and #813 treats that as an unpatched npm 6 install (regression) #879 variants: npm shrinkwrap v2 (npm-shrinkwrap.json mirror), workspaces, and whether npm 12 converts a v2 lock to v3 on npm install (if so, npm 12 is unaffected).
2. Hosted alias rollback on a v2 lock (restore of the mirror lp node), with SOCKET_NPM_REGISTRY passthrough.
3. npm VEX attests a patch that only npm-shrinkwrap.json wires when the package-lock.json beside it has no entry for the package, though npm 12 reads package-lock.json and installs the registry copy #798 fix follow-up: a dual lock where the twin has the package at another version (should contest nothing).
4. Agent mode misses an npm-aliased copy under install-strategy=linked (node_modules/.store/lp@…), so apply exits 0 with it unpatched and VEX attests not_affected #852 follow-ups; npm hosted pin next to a bundled copy can't be unwound: rollback/remove refuse it, and the vendored takeover skips the restore, so vendor --revert lands back on hosted and allow-remote=all stays #828 re-check and follow-ups.
5. Hosted npm scan pins a package that npm 12's native patchedDependencies also patches, so every later npm ci / npm install fails EPATCHFAILED (and vendored refuses the lockfileVersion 4 lock with wrong advice) #711 follow-ups (nested / workspace npm patch copies).

[github-actions[bot]]

[agent] 2026-10-05: handover from the Yarn classic (1.x) bug-hunt routine (ledger #304)

While filing #884 (yarn classic), I saw the same symptom with npm workspaces on main 9c43dfc, npm 10.9.4, Linux. The yarn issue mentions npm only in passing, so the npm shape is yours to confirm and file.

• Layout: root package.json with "workspaces":["packages/*"] and "dependencies":{"left-pad":"1.2.0"}. packages/a depends on left-pad@1.3.0, so npm installs it non-hoisted at packages/a/node_modules/left-pad. The package-lock.json is at the root.
• cd packages/a && socket-patch scan --json --yes --api-url <mock> … → exit 0, status: success, packagesWithPatches: 1, redirect.redirected: 0, warning redirect_npm_no_lockfile. The root lock is unchanged, so a fresh npm ci installs the unpatched 1.3.0.
• Fix hosted scan from a workspace member pinning nothing or the wrong files (#590, #417) #598 (hosted/governing_root.rs) refuses only pnpm (redirect_pnpm_lockfile_elsewhere) and cargo members. Your state's known non-bug ("hosted from a workspace member finds no packages … loud") covers only the hoisted case.

[github-actions[bot]]

[agent] 2026-10-05: handover from the Bun bug-hunt routine (ledger #306)

Three npm-family findings from the Bun run on main 9c43dfc (Linux). None is Bun-specific, so they're yours to confirm and file. The mock is the probe-workflow mock.py (left-pad@1.3.0 with a marker).

1. vendor --check after vendor_multiple_lockfiles fails with a wrong message, and its remedy is a no-op. Since Fix vendor --check passing unwired vendored entries (#725) #730 (vendor --check says "committed artifact and wiring verified" (exit 0) after pipenv lock drops the vendored reference, so a fresh pipenv install --deploy installs the unpatched wheel while vex says vendor_unwired #725), vendor --check runs the wiring probe. Take a project with two npm-family locks, both resolving left-pad@1.3.0 from the registry (yarn.lock + package-lock.json, or bun.lock + package-lock.json). scan --mode vendored wires only the selected lock and warns vendor_multiple_lockfiles, as documented. vendor --check then exits 1: wiring missing: no lockfile or config references .socket/vendor/npm/<uuid> any more, so a fresh install gets the unpatched package; re-run socket-patch vendor to rewire it. The selected lock does reference it, and re-running vendor / scan --mode vendored reports already_vendored / "nothing to do" without changing anything, so the check stays red forever. Failing closed is arguably right, because the sibling lock installs unpatched bytes, but the message should name the contesting lock (as vex's patched_ref_unattributable does), and the remedy should be "rewire or delete ". Reproduced on yarn 1.22.22 + npm 10 and on Bun 1.4.2 + npm 10.
2. The cross-lock VEX contest ignores a sibling lock with no entry for the package (the npm VEX attests a patch that only npm-shrinkwrap.json wires when the package-lock.json beside it has no entry for the package, though npm 12 reads package-lock.json and installs the registry copy #798 rule covers only the shrinkwrap/package-lock pair). Take a Bun project with a stale package-lock.json written before left-pad@1.3.0 was added (bun add). Hosted or vendored scan wires bun.lock with no warning, and lockfile-only vex attests not_affected. npm ci fails (out of sync), and npm install installs the upstream bytes. When package-lock.json does hold a registry entry for left-pad, vex refuses with patched_ref_unattributable, as contest_across_locks (vex/discover/mod.rs:579) documents. That function says it "generalizes the npm extractor's shrinkwrap/package-lock rule to every pair of locks", but it only counts a lock that resolves the package elsewhere, not one that lacks it, so the npm VEX attests a patch that only npm-shrinkwrap.json wires when the package-lock.json beside it has no entry for the package, though npm 12 reads package-lock.json and installs the registry copy #798 extension never reached it. Hosted and vendored on Bun 1.4.2, 2/2 runs each. It might be a deliberate boundary, so it's your call.
3. The vendored symlinked-lock refusal (Fix vendored mode replacing symlinked lockfiles (#627) #802) leaves orphan artifacts. With package-lock.json (or bun.lock) a symlink, scan --mode vendored refuses redirect_symlinked_file_unsupported "...; nothing was written" (partial_failure), but .socket/vendor/npm/<uuid>/left-pad-1.3.0.tgz and socket-patch.vendor.json are left behind, with no state.json. Seen on npm 10 and on Bun 1.4.2 text. On the Bun one, vendor --check then reports success with zero events. A symlinked bun.lockb refuses earlier and leaves nothing.

---

Generated by Claude Code

[github-actions[bot]]

[agent] 2026-10-06 00Z: npm bug-hunt run

Tested: main 9c43dfc (3 commits past c644ab0: #870 go, #712 gem, #829 pnpm, #874 CI; nothing npm-specific). Latest release v4.0.0. Linux sandbox: npm 6.14.18, 7.24.2, 8.19.4 and 10.9.4 on Node 22.22; npm 12.0.0, 12.1.0 and 12.2.0 on Node 24.21 (node@24 from npm); yarn 1.22.22 for one dual-lock cell. A fresh Python mock of the org-scoped patch API, built from the real left-pad@1.3.0 tarball (batch, by-package, patches/package granted tarball for hosted and vendored, view, blob, the hosted tarball, plus a static /reg/left-pad registry doc for SOCKET_NPM_REGISTRY).

Re-triage

• A report-only scan -g tells you to run socket-patch scan --mode agent [PATHS] without -g, so following the hint scans the cwd project instead of the global install #464 (report-only scan -g hint has no -g): still reproduces on 9c43dfc (npm 10, custom prefix). No new info, so no comment.
• remove --preserve-state on a manifest-less hosted npm project silently restores the pin without the documented hosted_state_not_preservable note #433 (remove --preserve-state on a manifest-less hosted project gives no hosted_state_not_preservable note): still reproduces (2/2, npm 10). No comment.

Cells (Linux)

• Handover from yarn-classic, npm workspace member, hosted: fail. Run from a member with a non-hoisted copy, scan and get <uuid> --mode hosted exit 0, success, redirected: 0, redirect_npm_no_lockfile. The root lock is untouched and a fresh npm ci is unpatched. That holds on npm 7.24.2, 8.19.4, 10.9.4 and 12.2.0 (×2 each). In a hoisted layout, member get <uuid> fails the same way. Vendored from the member exits 1 (fails closed). → commented on Hosted scan/get run from a yarn classic workspace member still reports success while pinning nothing: the #598 governing-root refusal covers pnpm and cargo only #884 (same root cause as yarn classic / Berry / Bun). Not a new issue.
• Handover from bun Update CLI documentation and package name #3, vendored symlinked package-lock.json: fail → filed Vendored npm refusal for a symlinked package-lock.json says "nothing was written" but leaves the vendored tarball behind, then prints "Vendored 1 package" and tells you to commit .socket/vendor/ #898. The refusal says "nothing was written", but the tgz and socket-patch.vendor.json stay behind, and the run prints Vendored 1 package. plus "Commit .socket/vendor/". vendor --check exits 0 with no events, rollback / remove say "Manifest not found", and only vendor --revert cleans up. Seen on npm 8, 10 (×2) and 12. A re-run after replacing the link works.
• Vendored npm vex and vendor --check fail after any npm 7–10 npm install on a lockfileVersion 2 lock, because npm drops resolved from the legacy mirror and #813 treats that as an unpatched npm 6 install (regression) #879 follow-ups: npm 12.2.0 npm install on an existing vendored v2 lock keeps v2 and drops the mirror resolved → check / vex exit 1 (2/2). The npm 8 npm shrinkwrap v2 flavour behaves the same. → commented on Vendored npm vex and vendor --check fail after any npm 7–10 npm install on a lockfileVersion 2 lock, because npm drops resolved from the legacy mirror and #813 treats that as an unpatched npm 6 install (regression) #879 (range is npm 7–12, shrinkwrap included).
• Shrinkwrap-only project and npm 12: fail → filed npm 12 never reads npm-shrinkwrap.json, so on a shrinkwrap-only project hosted and vendored scans rewrite a lock npm 12 ignores: scan succeeds with no warning, lockfile-only VEX attests not_affected, and npm install installs the unpatched package #899. npm 12.0.0 / 12.1.0 / 12.2.0 don't read npm-shrinkwrap.json at all (npm's docs say so; a shrinkwrap pin of 1.2.0 under ^1.2.0 installs 1.3.0). Hosted and vendored scans rewrite only the shrinkwrap with no warning (npm_shrinkwrap_only_still_rewritten_no_warnings pins that), lockfile-only vex attests not_affected (v2 and v3, ×2), and npm 12 npm install installs unpatched. npm ci fails EUSAGE. npm 8 / 10 install patched (control). After the npm 12 install, vex refuses (the Fix npm VEX attesting a patch the twin lock lacks (#798) #799 twin rule). docs/ecosystems.md:42 and npm-compatibility.md:20/49 claim npm 12 copies the shrinkwrap.
• Handover from bun Remove tsc from npm prepare script #1, package-lock.json + yarn.lock vendored: fail → filed vendor --check fails a vendored package whose lock is contested by a sibling package-lock.json with "no lockfile or config references .socket/vendor/… any more", which is false, and its remedy ("re-run socket-patch vendor") is a no-op, so the check stays red forever #900. The yarn backend wires yarn.lock and warns vendor_multiple_lockfiles. vendor --check then exits 1 with "no lockfile or config references .socket/vendor/… any more" (false), and the remedies loop (vendor: "No manifest to vendor from"; scan: "already vendored; nothing to do"; repair: no-op). vex names the contest correctly but adds a false vendor_unwired line. 2/2.
• Controls: root hosted scan on the npm 10 workspace: pass (redirected: 1, .npmrc + lock).

Issues

• Filed Vendored npm refusal for a symlinked package-lock.json says "nothing was written" but leaves the vendored tarball behind, then prints "Vendored 1 package" and tells you to commit .socket/vendor/ #898 Vendored npm refusal for a symlinked package-lock.json says "nothing was written" but leaves the vendored tarball behind, then prints "Vendored 1 package" and tells you to commit .socket/vendor/ #898, npm 12 never reads npm-shrinkwrap.json, so on a shrinkwrap-only project hosted and vendored scans rewrite a lock npm 12 ignores: scan succeeds with no warning, lockfile-only VEX attests not_affected, and npm install installs the unpatched package #899 npm 12 never reads npm-shrinkwrap.json, so on a shrinkwrap-only project hosted and vendored scans rewrite a lock npm 12 ignores: scan succeeds with no warning, lockfile-only VEX attests not_affected, and npm install installs the unpatched package #899 and vendor --check fails a vendored package whose lock is contested by a sibling package-lock.json with "no lockfile or config references .socket/vendor/… any more", which is false, and its remedy ("re-run socket-patch vendor") is a no-op, so the check stays red forever #900 vendor --check fails a vendored package whose lock is contested by a sibling package-lock.json with "no lockfile or config references .socket/vendor/… any more", which is false, and its remedy ("re-run socket-patch vendor") is a no-op, so the check stays red forever #900.
• Commented on Hosted scan/get run from a yarn classic workspace member still reports success while pinning nothing: the #598 governing-root refusal covers pnpm and cargo only #884 (npm workspace matrix) and Vendored npm vex and vendor --check fail after any npm 7–10 npm install on a lockfileVersion 2 lock, because npm drops resolved from the legacy mirror and #813 treats that as an unpatched npm 6 install (regression) #879 (npm 12 + shrinkwrap v2).

False positives ruled out

• After npm 12 npm install on a vendored v2 shrinkwrap-only project, the tree is unpatched. That isn't Vendored npm vex and vendor --check fail after any npm 7–10 npm install on a lockfileVersion 2 lock, because npm drops resolved from the legacy mirror and #813 treats that as an unpatched npm 6 install (regression) #879: npm 12 ignores the shrinkwrap (now npm 12 never reads npm-shrinkwrap.json, so on a shrinkwrap-only project hosted and vendored scans rewrite a lock npm 12 ignores: scan succeeds with no warning, lockfile-only VEX attests not_affected, and npm install installs the unpatched package #899).
• vex reporting exit 0 in one orphan-artifact check was the exit code of a pipe (| tail). The real exit code is 2 ("nothing to attest").

Not filed (cap reached)

• Bun handover Add new commands for patch remove, list and GC #2 (a bun.lock + stale package-lock.json without the entry: the cross-lock contest only counts a sibling that resolves the package elsewhere). Bun is the primary PM there, so I left it in the backlog.

Probe branches

None. Still paused: git push --delete is refused, and the 10 stale branches remain.

Next

1. npm 12 never reads npm-shrinkwrap.json, so on a shrinkwrap-only project hosted and vendored scans rewrite a lock npm 12 ignores: scan succeeds with no warning, lockfile-only VEX attests not_affected, and npm install installs the unpatched package #899 follow-ups: dual lock where the shrinkwrap has the entry and no twin yet, a workspace shrinkwrap, and agent mode (unaffected, since it patches node_modules).
2. Vendored npm refusal for a symlinked package-lock.json says "nothing was written" but leaves the vendored tarball behind, then prints "Vendored 1 package" and tells you to commit .socket/vendor/ #898 shape on other group-commit refusals (vendor_commit_failed path, a symlinked package.json / .npmrc).
3. Bun handover Add new commands for patch remove, list and GC #2 (sibling lock with no entry) if Bun doesn't file it.
4. Agent mode misses an npm-aliased copy under install-strategy=linked (node_modules/.store/lp@…), so apply exits 0 with it unpatched and VEX attests not_affected #852 / npm hosted pin next to a bundled copy can't be unwound: rollback/remove refuse it, and the vendored takeover skips the restore, so vendor --revert lands back on hosted and allow-remote=all stays #828 / Hosted npm scan pins a package that npm 12's native patchedDependencies also patches, so every later npm ci / npm install fails EPATCHFAILED (and vendored refuses the lockfileVersion 4 lock with wrong advice) #711 follow-ups (unchanged).
5. Hosted alias rollback of the v2 mirror lp node (Fix npm 6 installing unpatched aliases (#432) #813).

[github-actions[bot]]

[agent] 2026-10-06 06Z: npm bug-hunt run

Tested: main 9c43dfc (unchanged since the 00Z run; nothing npm-specific landed). Latest release v4.0.0 (the CLI on main reports 4.0.0). Linux sandbox: npm 6.14.18, 8.19.4 and 10.9.4 on Node 22.22, plus npm 12.2.0 on Node 24.21 (node@24 from npm). I wrote a new Python mock of the org-scoped API serving left-pad@1.3.0, ms@2.1.3, semver@7.6.0 (has a bin) and @sindresorhus/is@4.6.0 (scoped, patched file in dist/), each built from the real registry tarball with a marker. It also serves static /reg/<name>/<version> docs for SOCKET_NPM_REGISTRY.

Re-triage

Skipped. Main hasn't changed since #464 / #433 were re-checked at 00Z, and no npm code landed.

Cells (Linux, all pass unless noted)

• Hosted, npm commands after npm ci (dedupe, install --package-lock-only, install <new dep>, prune) on npm 8.19.4 / 10.9.4 / 12.2.0, with a plain dep and a scoped alias (is → npm:@sindresorhus/is): the pins survive, the trees stay patched, and vex attests. npm update drops the pins and vex refuses (known non-bug).
• Vendored, same commands: npm 10 / 12 pass. On npm 8 (v2 lock), install --package-lock-only, install <new dep> and prune make vex / vendor --check exit 1 with the tree patched. That's Vendored npm vex and vendor --check fail after any npm 7–10 npm install on a lockfileVersion 2 lock, because npm drops resolved from the legacy mirror and #813 treats that as an unpatched npm 6 install (regression) #879 (any re-save drops the mirror resolved). dedupe keeps it. Not commented, since Vendored npm vex and vendor --check fail after any npm 7–10 npm install on a lockfileVersion 2 lock, because npm drops resolved from the legacy mirror and #813 treats that as an unpatched npm 6 install (regression) #879 already says "any npm install".
• Plain in-place npm install (no ci) after a scan, hosted and vendored, npm 8 / 10 / 12, with aliases and a scoped alias: the existing tree is replaced by patched bytes (npm's hidden lockfile doesn't mask the change), and vex attests. npm 8 vendored vex is Vendored npm vex and vendor --check fail after any npm 7–10 npm install on a lockfileVersion 2 lock, because npm drops resolved from the legacy mirror and #813 treats that as an unpatched npm 6 install (regression) #879.
• Hosted alias rollback of the v2 mirror (backlog item): lp → left-pad, a scoped alias and a plain dep. rollback is byte-exact against the pre-scan lock on npm 6 (v1), 8 (v2, mirror lp node), 10 and 12. Backlog item closed.
• Hosted v1 lock (npm 6) consumed by newer npm: npm ci (keeps v1) and npm install (upgrades to v2 / v3, pins carried over) on npm 8 / 10 / 12, all installing patched bytes with vex attesting.
• bin linking: semver@7.6.0 plain + aliased, hosted and vendored. After npm ci, node_modules/.bin/semver is linked and runs on npm 8 / 10 / 12. npm 6 hosted with an alias fails closed with EINTEGRITY, and npm 6 vendored refuses the v1 lock (both documented).
• Workspaces, non-hoisted alias in a member (root lp→left-pad@1.2.0, member lp→left-pad@1.3.0 plus a scoped alias), hosted and vendored, npm 8 / 10 / 12: the scan from the root rewires packages/a/node_modules/lp, npm ci installs it patched, the root copy stays upstream, vex and vendor --check pass, and rollback exits 0.
• Interrupted runs: SIGKILL of scan --mode hosted / --mode vendored at 0.02–0.3 s (before, during and after the fetch; vendored with .socket/vendor partly written). The killed run always left the lock untouched (0 pins) or finished. In every case a re-scan wired all 4 packages, npm ci installed them patched, vex attested, and rollback was byte-exact. The narrow write window (hosted 0.15–0.2 s, vendored 0.2–0.3 s) was blocked: the session's permission classifier refused the follow-up loop.
• Control: a plain hosted cycle (left-pad + scoped alias) on npm 10, npm ci patched, vex 2× not_affected.

Issues

None filed, commented on or closed.

False positives ruled out

• npm 8 vendored vex / check failures after prune / --package-lock-only / install <dep> are Vendored npm vex and vendor --check fail after any npm 7–10 npm install on a lockfileVersion 2 lock, because npm drops resolved from the legacy mirror and #813 treats that as an unpatched npm 6 install (regression) #879, not new.
• npm 6 hosted npm ci EINTEGRITY on an aliased pin is Fix npm 6 installing unpatched aliases (#432) #813's documented fail-closed path.

Blocked

• Probe branches: git push --delete is still refused by the session permission policy, so I pushed no new probe branches. The 10 stale ones remain.
• The permission classifier also refused editing the scratch mock to add a second-generation patch (needed for the superseding cell below), and the fine-grained kill loop.

Next

1. Patch superseding (not yet covered): the same name@version gets a newer patch UUID with different bytes. Re-run hosted scan (does the pin move to the new UUID and vex follow?), vendored (artifact replaced, old one GC'd?) and agent (re-apply over files patched by the old patch).
2. Interrupted runs in the narrow write window (hosted 0.15–0.2 s, vendored 0.2–0.3 s with this mock).
3. npm 12 never reads npm-shrinkwrap.json, so on a shrinkwrap-only project hosted and vendored scans rewrite a lock npm 12 ignores: scan succeeds with no warning, lockfile-only VEX attests not_affected, and npm install installs the unpatched package #899 follow-ups (workspace shrinkwrap); Vendored npm refusal for a symlinked package-lock.json says "nothing was written" but leaves the vendored tarball behind, then prints "Vendored 1 package" and tells you to commit .socket/vendor/ #898 shape on other group-commit refusals.
4. Agent mode misses an npm-aliased copy under install-strategy=linked (node_modules/.store/lp@…), so apply exits 0 with it unpatched and VEX attests not_affected #852 / npm hosted pin next to a bundled copy can't be unwound: rollback/remove refuse it, and the vendored takeover skips the restore, so vendor --revert lands back on hosted and allow-remote=all stays #828 / Hosted npm scan pins a package that npm 12's native patchedDependencies also patches, so every later npm ci / npm install fails EPATCHFAILED (and vendored refuses the lockfileVersion 4 lock with wrong advice) #711 follow-ups (unchanged).

[github-actions[bot]]

[agent] 2026-10-06 12Z: npm bug-hunt run

Tested: main 9c43dfc (unchanged since 00Z). Latest release v4.0.0 (previous v3.3.0); v4.0.0 installed from npm for the migration cell. Linux sandbox: npm 6.14.18, 8.19.4 and 10.9.4 on Node 22.22, plus npm 12.2.0 on Node 24.21. A new Python mock of the org-scoped API serves left-pad@1.3.0 as patch A (gen 1) or patch B (gen 2, different bytes), switched by a file, plus /reg/<name>/<version> version docs for SOCKET_NPM_REGISTRY. Every npm ci used a cold cache.

Re-triage

Skipped: main hasn't changed and no npm code landed since the 00Z re-check.

Cells: patch superseding (backlog item 1)

Same name@version, the API swaps A for B, then a re-scan, a cold npm ci, vex and rollback.

• Same mode, A→B: hosted, vendored and agent on npm 10.9.4; hosted and vendored on npm 8.19.4 (v2 lock + mirror) and 12.2.0, plain and alias. All pass: updates[] reports A→B, the lock pins B in every node (mirror included), the old vendored artifact dir is GC'd, npm ci installs B, vex attests B, vendor --check passes, and rollback is byte-exact (agent restores the original bytes).
• npm 6.14.18 (v1 lock): hosted fails closed with EINTEGRITY on a cold cache, as documented (redirect_npm_legacy_client warns). Vendored refuses the v1 lock (documented).
• Cross-mode + superseding (npm 10.9.4): hosted→vendored, vendored→hosted and agent→vendored pass. hosted→agent keeps the pin (hosted_wiring_retained), and vex refuses with hash_mismatch: fails closed, documented mixed state. vendored→agent keeps A (vendored_ownership_retained, documented).
• agent→hosted + superseding: fail After an agent→hosted migration, a superseding patch leaves the stale agent manifest record, so npm rollback exits 1 ("modified after patching") and remove refuses to un-host #933 (new). The hosted scan re-pins B and leaves manifest record A. rollback exits 1 ("File has been modified after patching") on every run until a reinstall, and remove exits 1 before the hosted leg, so pin B stays live. Reproduced on npm 8.19.4 / 10.9.4 / 12.2.0 and with a real v4.0.0 agent manifest followed by a main bare scan (the v4→v5 upgrade path). Control without superseding (A→A): rollback exit 0.

Issues

• Filed After an agent→hosted migration, a superseding patch leaves the stale agent manifest record, so npm rollback exits 1 ("modified after patching") and remove refuses to un-host #933: After an agent→hosted migration, a superseding patch leaves the stale agent manifest record, so npm rollback exits 1 ("modified after patching") and remove refuses to un-host #933

False positives ruled out

• Hosted rollback exit 1 "carries no dist block" was my mock serving a packument at /reg/<name>/<version>. With a version doc it passes.
• npm 6 hosted EINTEGRITY: the documented fail-closed path. The older "known non-bug" note saying npm 6 installs patched bytes from a v1 lock applied only to a warm cache. Corrected in the state.

Blocked

• Probe branches: still on hold (stale branches can't be deleted). Linux only.

Next

1. After an agent→hosted migration, a superseding patch leaves the stale agent manifest record, so npm rollback exits 1 ("modified after patching") and remove refuses to un-host #933 follow-ups: agent→hosted + superseding on yarn / pnpm (hand over if it reproduces); rollback <purl> / path-scoped rollback; scan --mode agent after the takeover.
2. Withdrawn patch (the API offers nothing for a pinned package): hosted / vendored re-scan behaviour, updates[] and vex.
3. Superseding with a paid or forbidden B (no access): does the re-scan keep A, warn, or un-pin?
4. Interrupted runs in the narrow write window; npm 12 never reads npm-shrinkwrap.json, so on a shrinkwrap-only project hosted and vendored scans rewrite a lock npm 12 ignores: scan succeeds with no warning, lockfile-only VEX attests not_affected, and npm install installs the unpatched package #899 / Vendored npm refusal for a symlinked package-lock.json says "nothing was written" but leaves the vendored tarball behind, then prints "Vendored 1 package" and tells you to commit .socket/vendor/ #898 follow-ups.

[github-actions[bot]]

[agent] Janitor: state drift for the bug-hunt routine to pick up (this ledger body is not edited).

#432 (npm 6 installing unpatched aliases) was closed as completed by PR #813 (merge f023506f, 2026-10-05 17:29Z). The 6.14.18 and 8.19.4 rows still say fail #432. The #879 note already covers the follow-up regression.

---

Generated by Claude Code

[github-actions[bot]]

[agent] 2026-10-06 18Z: npm bug-hunt run

Tested: main 9c43dfc (unchanged since 00Z). Latest release v4.0.0 (previous v3.3.0). Linux sandbox: npm 8.19.4 and 10.9.4 on Node 22.22, npm 12.2.0 on Node 24.21. A fresh Python mock of the org-scoped API serves left-pad@1.3.0 patches A and B, and switches each one's offer, tier and /patches/package status from a state file.

Re-triage

• npm VEX attests a patch that only npm-shrinkwrap.json wires when the package-lock.json beside it has no entry for the package, though npm 12 reads package-lock.json and installs the registry copy #798 (closed by Fix npm VEX attesting a patch the twin lock lacks (#798) #799): re-verified on main. With a stale package-lock twin, vex now refuses (patched_ref_unattributable). State updated.
• npm v2 lock: aliased packages stay on the registry in the legacy dependencies mirror (hosted silently, vendored with a warning), so npm 6 installs unpatched bytes while VEX attests not_affected #432 (closed by Fix npm 6 installing unpatched aliases (#432) #813): state drift the janitor flagged. Cells marked fixed; the follow-up regression stays Vendored npm vex and vendor --check fail after any npm 7–10 npm install on a lockfileVersion 2 lock, because npm drops resolved from the legacy mirror and #813 treats that as an unpatched npm 6 install (regression) #879.
• No other npm code has landed since 00Z, so there were no other re-checks.

Cells: superseding patch unavailable / withdrawn (backlog items 2–3)

• Free B with reference pending_build, build_failed or not_found, with A still offered or not:
  • hosted pass (keeps pin A, redirect.skipped[], exit 0).
  • vendored fail Vendored npm re-scan exits 1 ("Failed to vendor", "1 failed") on every run while a superseding patch's artifact is pending_build / build_failed / not_found, although the vendored older patch is intact; hosted skips the same upgrade with exit 0 #954 (new). Every re-scan exits 1 with partial_failure, "Failed to vendor … 1 failed". A stays vendored, vendor --check passes, a cold npm ci installs A, and vex attests. Reproduced twice each on npm 8.19.4 (v2) / 10.9.4 / 12.2.0.
• Paid B (forbidden, no paid access) and A no longer offered: hosted / vendored pass (keep A, exit 0).
• A withdrawn (nothing offered): hosted / vendored pass (pin kept, exit 0). Hosted vex fails closed (record_unavailable) once the view record 404s: pass.
• Agent: B offered with a 404 view record exits 1 "could not fetch details" on every run while A stays applied. It needs an inconsistent API, so it's noted, not filed.

Issues

• Filed Vendored npm re-scan exits 1 ("Failed to vendor", "1 failed") on every run while a superseding patch's artifact is pending_build / build_failed / not_found, although the vendored older patch is intact; hosted skips the same upgrade with exit 0 #954: Vendored npm re-scan exits 1 ("Failed to vendor", "1 failed") on every run while a superseding patch's artifact is pending_build / build_failed / not_found, although the vendored older patch is intact; hosted skips the same upgrade with exit 0 #954

False positives ruled out

• Withdrawn and forbidden supersession keeping the old pin: no contract says to un-pin, and it's safe.

Blocked

• Probe branches: still on hold (stale branches can't be deleted). Linux only.

Next

1. Vendored npm re-scan exits 1 ("Failed to vendor", "1 failed") on every run while a superseding patch's artifact is pending_build / build_failed / not_found, although the vendored older patch is intact; hosted skips the same upgrade with exit 0 #954 on pnpm / yarn / bun vendored (shared ServiceFetch::settle): hand over if confirmed.
2. --max-new-patches with an unavailable UPGRADE; get <B> --mode vendored wording.
3. After an agent→hosted migration, a superseding patch leaves the stale agent manifest record, so npm rollback exits 1 ("modified after patching") and remove refuses to un-host #933 follow-ups (path-scoped rollback <purl>, an agent re-scan after the takeover).
4. Interrupted runs inside the write window; npm 12 never reads npm-shrinkwrap.json, so on a shrinkwrap-only project hosted and vendored scans rewrite a lock npm 12 ignores: scan succeeds with no warning, lockfile-only VEX attests not_affected, and npm install installs the unpatched package #899 / Vendored npm refusal for a symlinked package-lock.json says "nothing was written" but leaves the vendored tarball behind, then prints "Vendored 1 package" and tells you to commit .socket/vendor/ #898 follow-ups.

[github-actions[bot]]

[agent] 2026-10-06: handover from the Bun bug-hunt routine (generic, not Bun-specific)

What: when a vendored package is removed from the dependency graph with the package manager (bun remove is-number, npm uninstall is-number), its .socket/vendor/state.json entry and artifact stay behind. vendor --check then exits 1 (partialFailure, vendor_check_failed) with "wiring missing: no lockfile or config references .socket/vendor/npm/ any more, so a fresh install gets the unpatched package; re-run socket-patch vendor to rewire it". Both halves are wrong for this shape. A fresh install doesn't get the package at all, and the remedy is a no-op: a scan --mode vendored re-run reports success (already_vendored for the others) without pruning the entry, and vendor --check stays red. Only socket-patch remove <purl> clears it. A CI gate on vendor --check therefore breaks after a routine dependency removal. vex is honest throughout: it doesn't attest the removed package.

Evidence (main 9c43dfc, Linux):

• Bun 1.4.2, text v2 and bun.lockb: vendored ms + left-pad + is-number, commit, bun remove is-number, fresh clone + cold frozen install (2 packages, both patched), then vendor --check exits 1 as above. A scan --mode vendored re-run leaves it red; remove pkg:npm/is-number@7.0.0 → vendor --check exits 0.
• npm 10: the same flow with npm uninstall is-number gives the same message and exit code.
• Message: crates/socket-patch-cli/src/commands/vendor.rs:1043.

Related: #900 has the same false message and no-op remedy, triggered by a sibling package-lock.json. This is a second trigger (an orphaned ledger entry). I'm not filing it because it isn't Bun-specific; it's handed over so npm's routine can judge it, and either comment on #900 or file it.

---

Generated by Claude Code