Hacktoberfest 2026: the issues maintainers tagged for October, open and beginner-friendly. Browse Hacktoberfest issues

`socket npm outdated --json` appends an error object after valid JSON when npm exits with code 1

Open
  • Is something wrong?
#1,656 0 comments 0 reactions 0 assignees View on GitHub

Maintainers usually reply within 1 day

Nobody has claimed this yet.

Assessment

Difficulty
3/5
Estimated time
1-2 days
Newbie friendliness
65/100
Issue type
Bug
Clarity
Mostly clear
Activity status
Active
Tech stack
node.js, typescript
Domain
cli

Research direction

Start by reading src/commands/npm/cmd-npm.mts (lines 95-119) and src/cli.mts (lines 53-99) to see how subprocess rejection reaches the top-level error handler. Reproduce with socket npm outdated -g --depth=0 --json using an outdated global package. Done means npm's valid JSON and exit status 1 are kept, with no extra error object appended.

Written by the indexing model from the issue text.

Description

Description

When global packages are outdated, socket npm outdated -g --depth=0 --json outputs npm’s valid JSON result, then appends a second JSON object reporting an unexpected error.

The combined stdout cannot be parsed as a single JSON document. npm intentionally returns exit code 1 when updates are available, so this status alone does not indicate an unexpected failure.

Environment
  • Socket CLI: 1.8.4
  • npm: 12.0.2
  • Node.js: 24.18.0
  • macOS: 27.0.1, Apple Silicon
Steps to reproduce

With at least one outdated global npm package, run:

socket npm outdated -g --depth=0 --json

In my environment, npm itself is outdated but intentionally held at its installed version.

Actual behavior
  • Exit code: 1
  • stdout: valid outdated-package JSON, followed by:
{
  "ok": false,
  "message": "Unexpected error",
  "cause": "command failed"
}
  • stderr: empty in the standalone reproduction.

This also reproduces outside the maintenance automation that first exposed it. Socket version/help checks and successful update commands work.

Expected behavior

Preserve npm’s JSON output and exit status without appending a generic error object for the expected “updates available” result.

Investigation

The npm wrapper both awaits spawnPromise and registers an exit handler that waits for telemetry before exiting. A rejected subprocess promise can reach the top-level error handler, which prints the additional JSON object.

This suggests an interaction between subprocess rejection and asynchronous exit handling; it is not a verified root-cause patch.

I compared tags v1.8.4 and v1.10.1. The relevant wrapper, subprocess launcher, telemetry and error-handler files are identical, with unchanged relevant dependency versions. However, the runtime reproduction is on 1.8.4; I have not executed 1.10.1.

For reference, npm 12.2.1 also explicitly sets exit code 1 when outdated packages exist.

Dominant language
TypeScript
Stars
336
Forks
72
Avg merge
8h 18m
Merged PRs (30d)
70

Getting set up

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from SocketDev/socket-cli

All issues in SocketDev/socket-cli

Similar issues

More TypeScript issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.