How I would choose which npm patches to build, a live advisory taken from range check to 33 verified per-version backports, and a working patch desk that ranks targets from OSV and npm download data.
Turn npm advisories into patches for the exact versions people run, at a rate of dozens to hundreds a week, and build the tooling that keeps each one correct.
Most installs sit on old release lines. When a fix ships only in the newest major, every older line can move only by a breaking upgrade or a patch. Several vendors now sell those patches.
A patch desk that ranks targets by real backport demand, checks Socket's free catalog for coverage, triages lockfiles, and runs a real backport live in the browser.
| Takeaway | Why it matters for patching |
|---|---|
| The unit is a release line | A line with an open advisory and no fixed release in it is a patch target. Its weekly downloads are the demand. |
| Check the range against the code | Advisory ranges are often wider than the bug. A range check before porting saves effort and stops false alerts. |
| Reachability runs through callers | The largest caller decides real exposure: glob sets the option that makes the minimatch bug reachable. |
| One advisory, many patches | Socket patches exact versions, so one advisory fans out across every version people still install. Throughput comes from making each one cheap to port and verify. |
| Speed is the visible metric | Advisory to shipped patch, per severity. A pipeline with automatic gates is what shortens it. |
| Company | Founded 2020 by Feross Aboukhadijeh; USD 125M raised, including a USD 60M Series C at a USD 1B valuation in May 2026 led by Thrive Capital. Acquired Coana (Aarhus) in April 2025 for reachability analysis. |
| Patch product | Socket Certified Patches, launched November 2025 for JavaScript and TypeScript. Expanding them is a named use of the Series C. |
| Delivery | The open-source socket-patch CLI (v5.0.1, 13 October 2026) in hosted, vendored or in-place mode, across nine ecosystems. Hosted npm patches keep the upstream version and change the tarball integrity; v5 builds patched artifacts server side and emits OpenVEX. |
| Patch format | One record per exact version: a PURL, and for each changed file its SHA-256 before and after plus the patched file. One advisory can mean dozens of records (65 for one vm2 sandbox escape). |
| Free catalog | Critical and high patches are offered free; the public patch API serves the free records by GHSA, package or patch ID. |
The differences are in how a patched build is named, how it reaches the install, and how fast the catalog grows.
| Vendor | Delivery | Patched version | Notable |
|---|---|---|---|
| Socket | CLI hosted lockfile rewrite, vendored or in place; GitHub App PR | npm: same version, new integrity | No code change for the user; VEX covers scanners that read only name and version. Nine ecosystems. |
| Root.io | Patched packages and its own registry; advisories published to OSV | -root.io.N; white-label -aikido.N | Publishes to OSV, so its pace is measurable: npm records grew from 94 in June to 494 in October 2026. |
| Chainguard Libraries | Chainguard registry; a CLI writes pins and overrides | -cgr.N prerelease | A prerelease never matches a normal caret range, so adoption needs explicit pins. |
| Endor Labs | Hosted repository with Artifactory and Nexus guides | -endor-latest or date-stamped | Bundled with reachability-based prioritisation. |
| Seal Security | CLI and GitHub Action replace packages from its artifact server | -sp1 style | Covers application and Linux OS packages. |
| HeroDevs NES | Private npm registry with a token | Per-product releases | Long-term support for end-of-life frameworks (Node.js 12 to 18, AngularJS, Vue 2). |
From each vendor's docs and OSV's public data dump; Root's monthly counts from its OSV ecosystem export.
Read on 4 November 2026. A fast-moving product leaves a few public surfaces a version behind; each item below is a small fix.
| Item | What the sources say | Effect |
|---|---|---|
| CLI versions | npm and crates.io publish socket-patch 5.0.1; PyPI still has 4.0.0. | Python users get the pre-v5 command set. |
| Command names | Earlier blog posts use socket patch add GHSA-...; v5 uses get and scan. | Copy-paste from a post fails. |
| Where patches live | The features page says patches are stored in your repo; the v5 default is hosted mode, served from the patch service. | Readers expect vendored files. |
| Docs coverage | docs.socket.dev documents 21 CLI commands; patching is documented in the socket-patch repository. | A docs page linking to it would help. |
| Where speed shows | Among the 100 most recent critical npm advisories, the free catalog's patches arrived 9 to 20 days after the advisory in the three cases timed (anonymous view, free tier only). | The number a faster pipeline moves. |
Published 30 October 2026 (CVE-2026-118764): a crafted glob makes minimatch's pattern optimiser double its pattern list and then compare every pair. The only fixed release is 11.0.1. I took it from advisory to verified patches.
| Range check | The advisory says introduced 0. firstPhasePreProcess() is absent from the published dist of 3.1.2, 5.1.6 and 6.2.0 and present from 7.0.0. Corrected range: 7.0.0 up to 11.0.1. |
| Reachability | The bug needs optimizationLevel 2; minimatch defaults to 1. glob 9, 10 and 11 construct minimatch with optimizationLevel: 2 and depend on minimatch ^8, ^9 and ^10, so any app passing a user-supplied pattern to glob() reaches it. |
| Backport | Upstream fix 77a0f5c applied to all 33 versions on 7.x to 10.x with at least 10,000 weekly downloads (499.8M of the 499.8M vulnerable weekly installs), in both the CommonJS and ESM builds: cap **/.. splitting at braceExpandMax (100,000 default where the option did not exist yet) and skip the pairwise dedupe above 1,000 patterns. Emitted as one patch record per exact version (PURL plus each file's SHA-256 before and after), keeping the upstream version number the way Socket's hosted npm patches do. |
| Gate 1: exploit | 14 repeats of **/../a/b at optimizationLevel 2: 9.5 to 37 times faster patched on 31 versions; on the other 2 the unpatched build did not finish inside the 20-second limit. Each run is a child process with a hard timeout. |
| Gate 2: upstream tests | The four cases in test/preprocess-limits.ts from the fix commit, ported: 4 of 4 pass on all 33 versions. |
| Gate 3: differential | Patched against original on 14 ordinary patterns, 15 paths and optimisation levels 0 to 2: 630 checks, 0 differences on every version. |
| Gate 4: fuzz | 1,000 seeded random patterns x 20 paths x 3 levels: 60,000 checks per version, 0 differences on all 33. |
| Socket coverage | Checked against Socket's public patch API on 4 November: no free patch for this advisory yet. |
| What I would file | The range correction to the GitHub advisory with this evidence; a note to glob's maintainer; the 33 patch records. |
Reproducible in the demo's Live backport tab: it downloads minimatch 9.0.9 from the npm CDN, applies the same edits in the browser and races both builds.
| Posting duty | How I would do it | Detailed in |
|---|---|---|
| Lead patching for high-impact npm vulnerabilities | Start every advisory with a range check against published code and a reachability check through the top callers, then backport to the latest release of each unfixed line. | ★, §05 |
| Help select and prioritise high-value patches | Rank patch targets (package line with no in-line fix) by downloads still on that line, severity, EPSS and advisories closed per patch; re-run daily as OSV and downloads move. | §05, demo |
| Scale to dozens or hundreds of patches a week | Most fixes are small. Make the transform, the per-version records, the gates and the release notes one pipeline per advisory, so a person reviews the diff and the gate results only. | §06 |
| Patch QA and testing tooling | Exploit with a hard timeout, ported upstream tests, differential runs against the original on generated inputs, and a check that every shipped build (CJS, ESM, minified) changed. | §06 |
| Automated detection and patch creation | Watch OSV for new npm advisories with fix commits; draft the backport from the fix diff; flag when anchors moved too far for a text transform and a person must port it. | §06 |
| APIs to deliver certified packages | A manifest per patch (advisory, upstream commit, lines, gate results, hashes) that the delivery API serves, so a customer can see why a patched version is safe. | §06 |
| Work with security researchers | Send range corrections and reachability notes back upstream, with the evidence, so the advisory database improves for everyone. | ★ |
A patch earns its place when many installs cannot reach a fix without a breaking change. The demo computes this live for any list of packages.
| Unit | Package release line: the major, or the minor for 0.x. A line with an open advisory and no fixed release in it is a patch target. |
| Demand | Weekly downloads of affected versions on that line, from npm's per-version download counts, evaluated against OSV's SEMVER ranges with a prerelease-aware comparator. |
| Score | (log10 downloads minus 3) x severity weight x (1 + 4 x EPSS), plus up to 100% when one patch closes several advisories on the same line. |
| Corrections | Where published code shows a range is too wide, the corrected range replaces it and the change is shown with its evidence. |
| Dead parents | Weight up lines held in place by an unmaintained parent (tough-cookie 2.x under request, 15.7M a week): those users cannot upgrade even if they want to. |
| Upstream backports | Check before spending effort: some maintainers backport to every major (minimatch did for GHSA-3ppc-4f35-3m26, 3.x to 10.x). |
| Coverage | The demo shows, per advisory, whether Socket's free catalog already has a patch and for which versions on the line. |
| Top of the queue on 4 Nov 2026 | tar 6.x (12 open advisories, 25.8M weekly downloads, newest fixes only in 7.x), undici 5.x (16 advisories, 28.1M), tar 4.x and 2.x, axios 0.21 and 0.27, postcss 7.x (22.7M), lodash 3.x. |
New npm advisory in OSV with a fix commit. Compute demand per line, check the range against published code, check the top callers for reachability. Discard targets with no real exposure.
Draft the transform from the fix diff, anchored on code text, for every build the package ships. Fail loudly on a moved anchor; a person ports those by hand.
Exploit with a hard timeout, ported upstream tests, differential and seeded fuzz runs against the original. All gates green or the patch does not ship.
One record per exact version: PURL, files with before and after hashes, the advisory, the gate results. Keep the upstream licence notice beside the patch licence.
Build the patched tarball server side and serve it to the CLI's hosted mode; emit VEX so scanners that read only name and version stop flagging a patched install.
Upstream range corrections and reachability notes; retire a patch when upstream ships an in-line fix.
Role: Vulnerability Research Engineer, Socket (public job posting, 2026).
OSV query and batch APIs, npm per-version download counts and registry metadata, FIRST EPSS, the GitHub Advisory Database, Socket's public patch API, the socket-patch repository and documentation, vendor documentation, and OSV's data dump. Read 4 November 2026.
The demo, the backport scripts and the verification are my own work for this application. Scores, weights and thresholds are my assumptions. The minimatch patch records follow the shape of Socket's public patch records; they are not Socket patches.
Demo: socket-patch-desk.pages.dev · GHSA-g3hv-75wg-m249 · minimatch fix 77a0f5c · socket-patch · OSV API · npm download counts · EPSS API · Chainguard Libraries · Endor Patches · HeroDevs NES
Independent homework for the Socket Vulnerability Research Engineer role · 2026 · edwardtay.com