Hacktoberfest 2026: the issues maintainers tagged for October, open and beginner-friendly. Browse Hacktoberfest issues

socket pnpm add / socket yarn add scan the alias name instead of the aliased package

Open Beginner friendly
  • Is something wrong?
#1,655 0 comments 0 reactions 0 assignees View on GitHub

Maintainers usually reply within 1 day

Nobody has claimed this yet.

Assessment

Difficulty
2/5
Estimated time
1-3 hours
Newbie friendliness
85/100
Issue type
Bug
Clarity
Clearly specified
Activity status
Active
Tech stack
node.js, typescript
Domain
cli, security

Research direction

Read src/utils/npm-spec.mts and the safeParseNpmSpec function; it lacks an alias branch and uses npm-package-arg result. Add handling for type 'alias' using subSpec to return the real package and version. Verify with SOCKET_CLI_DEBUG=1 socket pnpm add my-lodash@npm:[email protected] that pkg:npm/[email protected] is sent.

Written by the indexing model from the issue text.

Description

The shadow pnpm and yarn wrappers check packages with the Socket API before they install them. For an npm alias spec, the check looks up the alias name instead of the package that gets installed.

safeParseNpmSpec in src/utils/npm-spec.mts reads name and version from the npm-package-arg result. For an alias, npm-package-arg returns type: 'alias', sets name to the alias, and puts the real package in subSpec. The function has no branch for alias, so it returns the alias name with no version.

Command argument PURL sent for scanning Package installed
my-lodash@npm:[email protected] pkg:npm/my-lodash [email protected]
node-types@npm:@types/[email protected] pkg:npm/node-types @types/[email protected]

As a result, the installed package never gets checked. If an unrelated package has the alias name, its alerts are reported instead. socket yarn install has the same problem with aliased package.json dependencies such as "my-lodash": "npm:lodash@^4", because it builds name@version from each entry and passes the result to the same function.

Steps to reproduce

  1. Run SOCKET_CLI_DEBUG=1 socket pnpm add my-lodash@npm:[email protected].
  2. Check the packagePurls debug output.

Expected result

pkg:npm/[email protected]

Actual result

pkg:npm/my-lodash

Version

v1.x branch at 766b1e6 / [email protected].

Dominant language
TypeScript
Stars
336
Forks
72
Avg merge
8h 18m
Merged PRs (30d)
70

Getting set up

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from SocketDev/socket-cli

All issues in SocketDev/socket-cli

Similar issues

More TypeScript issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.