Skip npm lock entries installed from git or URLs

npm installs a git, remote-tarball or file: dependency from the
dependent's spec and ignores the lock entry's resolved. Hosted and
vendored mode rewired those entries anyway, so the scan reported the
package patched and vex attested it while npm ci installed the
original bytes.

Both rewriters now skip such entries with a loud stays-UNPATCHED
warning (vendored refuses when no registry copy is left), and vex no
longer attests a name@version while a non-registry copy of it is in
the lock.

Fixes #326

Assisted-by: Claude Code:claude-opus-5-5

Author: claude

crates/socket-patch-cli/tests/e2e_vendor_npm_build.rs

@@ -592,6 +592,102 @@ fn npm_vendor_vex_attests_against_vendored_tarball() {
     );
 }
 
+/// #326: a dependency installed from a remote-tarball spec (`"left-pad":
+/// "https://…/left-pad-1.3.0.tgz"`) is fetched from that url by `npm ci`,
+/// whatever the lock's `resolved` says. Vendoring used to rewire the entry
+/// and report `applied` (and `vex` attested it) while `npm ci` installed
+/// the original bytes. It must refuse, leave the lock untouched, and give
+/// `vex` nothing to attest.
+#[test]
+fn npm_vendor_refuses_a_remote_tarball_dependency() {
+    let suite = "e2e_vendor_npm_build (remote tarball)";
+    let Some(major) = npm_major_or_skip(suite) else {
+        return;
+    };
+    let tmp = tempfile::tempdir().unwrap();
+    let proj = tmp.path().join("proj");
+    std::fs::create_dir_all(&proj).unwrap();
+    std::fs::write(
+        proj.join("package.json"),
+        r#"{"name":"vendor-url-spec","version":"0.0.0","private":true}"#,
+    )
+    .unwrap();
+    let cache = tmp.path().join("npm-cache");
+    let url = format!("https://registry.npmjs.org/{DEP}/-/{DEP}-{DEP_VERSION}.tgz");
+    if !npm_e2e_common::install_fixture(suite, &proj, &cache, &url) {
+        return;
+    }
+    let pkg: serde_json::Value =
+        serde_json::from_slice(&std::fs::read(proj.join("package.json")).unwrap()).unwrap();
+    assert_eq!(
+        pkg["dependencies"][DEP], url,
+        "the fixture depends on the url spec: {pkg}"
+    );
+
+    let installed_index = proj.join("node_modules").join(DEP).join("index.js");
+    let orig = std::fs::read(&installed_index).expect("installed index.js");
+    let patched: Vec<u8> = [MARKER.as_bytes(), orig.as_slice()].concat();
+    let purl = format!("pkg:npm/{DEP}@{DEP_VERSION}");
+    const GHSA: &str = "GHSA-vend-npm-url";
+    stage_patch_with_vuln(&proj, &purl, "package/index.js", &orig, &patched, GHSA);
+    if v1_lock_is_refused(&proj, major) {
+        return;
+    }
+    let lock_before = std::fs::read(proj.join("package-lock.json")).unwrap();
+
+    let (_code, stdout, stderr) = run_socket(
+        &proj,
+        &[
+            "vendor",
+            "--json",
+            "--offline",
+            "--cwd",
+            proj.to_str().unwrap(),
+        ],
+    );
+    let env = parse_envelope(&stdout);
+    assert_eq!(
+        env["summary"]["applied"], 0,
+        "a url-spec dependency must not be vendored: {env}\nstderr:\n{stderr}"
+    );
+    assert!(
+        stdout.contains("vendor_lock_entry_not_rewritable") && stdout.contains("UNPATCHED"),
+        "the refusal must say why: {env}"
+    );
+    assert_eq!(
+        std::fs::read(proj.join("package-lock.json")).unwrap(),
+        lock_before,
+        "the lock is untouched"
+    );
+    assert!(
+        !proj.join(format!(".socket/vendor/npm/{UUID}")).exists(),
+        "no artifact is written"
+    );
+
+    let vex_path = proj.join("out.vex.json");
+    let (code, stdout, stderr) = run_socket(
+        &proj,
+        &[
+            "vex",
+            "--cwd",
+            proj.to_str().unwrap(),
+            "--output",
+            vex_path.to_str().unwrap(),
+            "--product",
+            "pkg:npm/app@1.0.0",
+        ],
+    );
+    let attested = std::fs::read(&vex_path)
+        .ok()
+        .and_then(|b| serde_json::from_slice::<serde_json::Value>(&b).ok())
+        .and_then(|doc| doc["statements"].as_array().map(|s| !s.is_empty()))
+        .unwrap_or(false);
+    assert!(
+        !attested,
+        "vex must not attest an unwired patch (exit {code}).\nstdout:\n{stdout}\nstderr:\n{stderr}"
+    );
+}
+
 /// get-driven twin of the capstone (v3.6): instead of hand-staging
 /// `.socket/` (manifest + blob) and running `vendor --offline`,
 /// `get <uuid> --mode vendored` resolves the SAME patch from a mocked

crates/socket-patch-core/src/patch/redirect/mod.rs

@@ -25,6 +25,7 @@ use serde_json::{json, Value};
 use crate::utils::composer_version::composer_versions_equivalent;
 use crate::utils::digest::is_hex64_lower;
 use crate::utils::line_endings::{to_lf, LineEndings};
+use crate::vendor::npm_origin::npm_non_registry_entries;
 use crate::vendor::yarn_berry_lock::yarnrc_compression_level;
 
 mod bun_binary;
@@ -859,6 +860,9 @@ fn rewrite_one_npm_lock(
                 .collect()
         })
         .unwrap_or_default();
+    // Entries npm installs from a git / url / `file:` spec: see
+    // `vendor::npm_origin` (#326).
+    let non_registry = npm_non_registry_entries(&lock);
     let mut changed = false;
     for dep in npm {
         let fname = full_name(dep);
@@ -906,6 +910,22 @@ fn rewrite_one_npm_lock(
                     });
                     continue;
                 }
+                // npm installs a git / url / `file:` dependency from the
+                // dependent's spec and ignores `resolved`, so a rewrite here
+                // would confirm (and VEX-attest) a patch that never installs.
+                if let Some(reason) = non_registry.get(key.as_str()) {
+                    matched_any = true;
+                    result.warnings.push(RewriteWarning {
+                        code: "redirect_npm_non_registry_entry_skipped".into(),
+                        detail: format!(
+                            "lock entry `{key}` is not installed from the registry ({reason}) \
+                             and CANNOT be redirected — npm installs it from that spec, so \
+                             that copy stays UNPATCHED; depend on the registry release to \
+                             patch it"
+                        ),
+                    });
+                    continue;
+                }
                 matched_any = true;
                 if let Some(edit) = rewrite_npm_entry(
                     entry,
@@ -13162,6 +13182,123 @@ mod tests {
         );
     }
 
+    /// #326: npm installs a git, remote-tarball or `file:` dependency from
+    /// the dependent's spec and ignores the lock's `resolved`, so rewiring
+    /// that entry would report (and VEX-attest) a patch `npm ci` never
+    /// installs. It must be skipped loudly, like a bundled copy.
+    #[test]
+    fn npm_non_registry_entries_are_skipped_with_loud_warning() {
+        let url = "https://registry.npmjs.org/left-pad/-/left-pad-1.3.0.tgz";
+        for (spec, resolved) in [
+            (
+                "github:stevemao/left-pad#v1.3.0",
+                "git+ssh://git@github.com/stevemao/left-pad.git#ff8e7ba",
+            ),
+            (url, url),
+            ("file:../left-pad-1.3.0.tgz", "file:../left-pad-1.3.0.tgz"),
+        ] {
+            let lock = json!({
+                "name": "app",
+                "lockfileVersion": 3,
+                "packages": {
+                    "": { "name": "app", "version": "0.0.0", "dependencies": { "left-pad": spec } },
+                    "node_modules/left-pad": {
+                        "version": "1.3.0",
+                        "resolved": resolved,
+                        "integrity": "sha512-UPSTREAM=="
+                    }
+                }
+            });
+            let mut files = BTreeMap::new();
+            files.insert(
+                "package-lock.json".to_string(),
+                serde_json::to_string_pretty(&lock).unwrap(),
+            );
+            let overrides = vec![npm_override(
+                "left-pad",
+                "1.3.0",
+                "http://patch.test/lp.tgz",
+                "sha512-PATCHED==",
+            )];
+            let r = rewrite_registry_redirect(&files, &overrides);
+            assert!(
+                r.files.is_empty() && r.edits.is_empty(),
+                "{spec}: a non-registry entry must not be rewired: {:?}",
+                r.edits
+            );
+            let skipped = r
+                .warnings
+                .iter()
+                .find(|w| w.code == "redirect_npm_non_registry_entry_skipped")
+                .unwrap_or_else(|| panic!("{spec}: the skip must warn: {:?}", r.warnings));
+            assert!(
+                skipped.detail.contains("UNPATCHED")
+                    && skipped.detail.contains("node_modules/left-pad"),
+                "{spec}: {}",
+                skipped.detail
+            );
+            assert!(
+                !warning_codes(&r).contains(&"redirect_npm_entry_not_found"),
+                "{spec}: the entry was found: {:?}",
+                r.warnings
+            );
+        }
+    }
+
+    /// #326, transitive: a nested git copy is skipped while the hoisted
+    /// registry copy of the same version is still redirected.
+    #[test]
+    fn npm_nested_git_copy_is_skipped_and_registry_copy_rewired() {
+        let lock = json!({
+            "name": "app",
+            "lockfileVersion": 3,
+            "packages": {
+                "": { "name": "app", "version": "0.0.0",
+                      "dependencies": { "a": "^1.0.0", "left-pad": "^1.3.0" } },
+                "node_modules/a": {
+                    "version": "1.0.0",
+                    "resolved": "https://registry.npmjs.org/a/-/a-1.0.0.tgz",
+                    "integrity": "sha512-A==",
+                    "dependencies": { "left-pad": "stevemao/left-pad#v1.3.0" }
+                },
+                "node_modules/a/node_modules/left-pad": {
+                    "version": "1.3.0",
+                    "resolved": "git+ssh://git@github.com/stevemao/left-pad.git#ff8e7ba"
+                },
+                "node_modules/left-pad": {
+                    "version": "1.3.0",
+                    "resolved": "https://registry.npmjs.org/left-pad/-/left-pad-1.3.0.tgz",
+                    "integrity": "sha512-UPSTREAM=="
+                }
+            }
+        });
+        let mut files = BTreeMap::new();
+        files.insert(
+            "package-lock.json".to_string(),
+            serde_json::to_string_pretty(&lock).unwrap(),
+        );
+        let overrides = vec![npm_override(
+            "left-pad",
+            "1.3.0",
+            "http://patch.test/lp.tgz",
+            "sha512-PATCHED==",
+        )];
+        let r = rewrite_registry_redirect(&files, &overrides);
+        assert_eq!(r.edits.len(), 1, "{:?}", r.edits);
+        assert_eq!(r.edits[0].key.as_deref(), Some("node_modules/left-pad"));
+        assert!(
+            warning_codes(&r).contains(&"redirect_npm_non_registry_entry_skipped"),
+            "{:?}",
+            r.warnings
+        );
+        let out: Value = serde_json::from_str(&r.files["package-lock.json"]).unwrap();
+        assert_eq!(
+            out["packages"]["node_modules/a/node_modules/left-pad"],
+            lock["packages"]["node_modules/a/node_modules/left-pad"],
+            "the git copy is byte-untouched"
+        );
+    }
+
     /// When the patched dep has both a regular entry and a bundled nested
     /// copy, the regular entry is redirected and the bundled copy is left
     /// byte-untouched behind the stays-UNPATCHED warning (partial coverage

crates/socket-patch-core/src/vendor/mod.rs

@@ -73,6 +73,7 @@ pub(crate) mod npm_common;
 pub(crate) mod npm_dir;
 pub mod npm_flavor;
 pub mod npm_lock;
+pub(crate) mod npm_origin;
 mod npm_pack;
 pub(crate) mod nuget_config;
 pub mod nuget_feed;