`socket pnpm install` fabricates alerts for packages not in the tree: pnpm v9 lockfile keys are truncated at the first underscore
Maintainers usually reply within 1 day
Nobody has claimed this yet.
Assessment
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Newbie friendliness
- 66/100
- Issue type
- Bug
- Clarity
- Mostly clear
- Activity status
- Quiet
- Tech stack
- typescript
Research direction
Reproduce the issue with the pnpm v9 lockfile shown, then inspect stripPnpmPeerSuffix in dist/utils.js and its use through extractPurlsFromPnpmLockfile and getAlertsMapFromPnpmLockfile in dist/shadow-pnpm-bin2.js. Done means underscore-named packages retain their full names and versions in submitted purls, while peer suffixes are still handled for the relevant lockfile format and the reproduction no longer reports the unrelated string alert.
Written by the indexing model from the issue text.
Description
Summary
The pnpm shadow wrapper's lockfile scan mangles the name of any package whose name contains an underscore, submitting a purl for a different, unrelated package. In any pnpm-v9 project that depends on string_decoder (i.e. effectively every project, via readable-stream), socket pnpm install reports a High CVE for [email protected] — a package that is not in the dependency tree at all — and exits 1.
Mechanism
stripPnpmPeerSuffix truncates a lockfile package key at the first ( or _:
function stripPnpmPeerSuffix(depPath) {
const parenIndex = depPath.indexOf('(');
const index = parenIndex === -1 ? depPath.indexOf('_') : parenIndex;
return index === -1 ? depPath : depPath.slice(0, index);
}
The _ case is the pnpm lockfile v5 peer-suffix convention (/foo/[email protected]). In lockfile v9, package keys are plain name@version, where _ is an ordinary legal character in npm package names. So extractPurlsFromPnpmLockfile maps:
| Lockfile key (v9) | Submitted purl |
|---|---|
[email protected] |
pkg:npm/string (versionless, wrong package) |
[email protected] |
pkg:npm/evp |
@types/[email protected] |
pkg:npm/@types/babel |
The batch purl endpoint resolves the versionless pkg:npm/string to the real (unrelated) string package, whose latest version 3.3.3 carries a High CVE — which the wrapper's default filter treats as fatal, regardless of org policy. The other two mangled names happen not to resolve to alerting packages, which is why only [email protected] surfaces.
Reproduction
mkdir repro && cd repro
npm init -y > /dev/null
printf 'lockfileVersion: "9.0"\npackages:\n [email protected]:\n resolution: {integrity: sha512-zOgAKMkjXbleOl9U5k7DBVdNwCRJW8ANhbJpEbriDmqu3nrOJPVHHqAmU7hBVBkoGuZbSpUnGdgOSg74RSPikw==}\nsnapshots:\n [email protected]:\n dependencies:\n safe-buffer: 5.2.1\n' > pnpm-lock.yaml
SOCKET_CLI_DEBUG=1 DEBUG='*' socket pnpm install 2>&1 | grep -A5 purls
# → purls include 'pkg:npm/string' (no version), and the run fails on [email protected]'s High CVE
(Alternatively: any real pnpm-v9 project with string_decoder in its lockfile reproduces it — we hit it in a 1,500-package workspace.)
Versions
Observed identical in @socketsecurity/[email protected], [email protected], and [email protected] (latest as of 2026-08-08): dist/utils.js stripPnpmPeerSuffix, reached via extractPurlsFromPnpmLockfile → getAlertsMapFromPnpmLockfile in dist/shadow-pnpm-bin2.js's install path.
Suggested fix
Only apply the _ truncation to v5-style dep paths (those beginning with / and using /name/version shape), or key the suffix-stripping on the lockfile's lockfileVersion. For v9 name@version keys, peer suffixes only ever appear in parentheses.
Impact
socket pnpm installfails spuriously (exit 1) for effectively any pnpm-v9 tree containing an underscore-named package that maps onto an alerting package name.- The submitted purl set silently omits the real packages (
string_decoder,evp_bytestokey,@types/babel__*are never actually checked).
- Dominant language
- TypeScript
- Stars
- 317
- Forks
- 65
- Avg merge
- 1h 26m
- Merged PRs (30d)
- 30
Getting set up
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from SocketDev/socket-cli
-
bug
Difficulty 2/5 1-3 hours Newbie friendliness 78/100
SocketDev/socket-cli#1160 · 1 comment ·
Maintainers usually reply within 1 day
-
Difficulty 4/5 3-5 days Newbie friendliness 48/100
SocketDev/socket-cli#1547 ·
Maintainers usually reply within 1 day
-
Difficulty 5/5 Over a week Newbie friendliness 35/100
SocketDev/socket-cli#1525 ·
Maintainers usually reply within 1 day
-
Difficulty 3/5 1-2 days Newbie friendliness 45/100
SocketDev/socket-cli#1517 ·
Maintainers usually reply within 1 day
-
Difficulty 3/5 1-2 days Newbie friendliness 68/100
SocketDev/socket-cli#1498 ·
Maintainers usually reply within 1 day
All issues in SocketDev/socket-cli
Similar issues
-
Difficulty 2/5 1-3 hours Newbie friendliness 84/100
opengovsg/FormSG#10118 · 1 comment ·
Maintainers usually reply within 1 day
-
ai-driven-qa bug claude
Difficulty 1/5 Under an hour Newbie friendliness 75/100
linagora/twake-calendar-frontend#1434 · 1 comment ·
Maintainers usually reply within 1 day
-
check:passed streams:add
Difficulty 2/5 1-3 hours Newbie friendliness 70/100
iptv-org/iptv#52824 · 2 comments ·
Maintainers usually reply within 1 day
-
Difficulty 2/5 Half a day Newbie friendliness 78/100
jaegertracing/jaeger-ui#4512 ·
Maintainers usually reply within 1 day
-
area:ide documentation enhancement platform:macos platform:vscode
Difficulty 1/5 1-3 hours Newbie friendliness 88/100
anthropics/claude-code#97389 ·
Maintainers usually reply within 1 day