diff --git a/‎crates/socket-patch-cli/tests/e2e_vex_lockfile/npm.rs‎
Lines changed: 34 additions & 0 deletions b/‎crates/socket-patch-cli/tests/e2e_vex_lockfile/npm.rs‎
Lines changed: 34 additions & 0 deletions
diff --git a/‎crates/socket-patch-core/src/vex/discover/npm.rs‎
Lines changed: 199 additions & 10 deletions b/‎crates/socket-patch-core/src/vex/discover/npm.rs‎
Lines changed: 199 additions & 10 deletions
diff --git a/‎docs/testing/npm-compatibility.md‎
Lines changed: 4 additions & 1 deletion b/‎docs/testing/npm-compatibility.md‎
Lines changed: 4 additions & 1 deletion
@@ -361,6 +361,40 @@ fn dual_lock_with_one_lock_on_the_registry_attests_nothing() {
     }
 }
 
+/// REGRESSION (#798): the same holds when the other lock has NO entry for
+/// the package (a stale twin an npm <= 11 teammate left behind): npm
+/// re-resolves the missing entry from the registry, so whichever npm major
+/// reads that lock installs unpatched bytes. Nothing attests.
+#[test]
+fn dual_lock_with_one_lock_missing_the_package_attests_nothing() {
+    let api = api_for(UUID, PURL);
+    let stale = json!({
+        "name": "app", "version": "1.0.0", "lockfileVersion": 3, "requires": true,
+        "packages": { "": { "name": "app", "version": "1.0.0" } },
+    });
+    for (mode, wired) in [
+        ("hosted", hosted_url("patch.socket.dev", UUID)),
+        ("vendored", format!("file:{}", vendored_rel(UUID))),
+    ] {
+        for stale_file in ["package-lock.json", "npm-shrinkwrap.json"] {
+            let tmp = tempfile::tempdir().unwrap();
+            let p = tmp.path();
+            write_locks(p, Shape::Dual, &wired, PIN);
+            std::fs::write(p.join(stale_file), stale.to_string()).unwrap();
+            write_artifact(p, UUID, PATCHED);
+            let out = run_vex(&binary(), p, &VexRun::online(&api));
+            assert_ne!(out.code, Some(0), "{mode}, stale {stale_file}:\n{out}");
+            assert_absent(out.doc.as_ref(), PURL);
+            let text = out.stdout.clone() + &out.stderr;
+            assert!(
+                text.contains("patched_ref_unattributable")
+                    && text.contains("has no entry for the package"),
+                "the contested wiring must be explained:\n{out}"
+            );
+        }
+    }
+}
+
 /// Standalone `vex` over a manifest-less checkout honors the output
 /// conventions every `vex` run does: `-O -` prints the document to stdout
 /// (never a file named `-`) with the summary on stderr, and `--dry-run`
 
@@ -72,13 +72,30 @@ pub(crate) async fn extract(ctx: &DiscoverCtx<'_>, out: &mut Discovery) {
 }
 
 /// What one parsed npm lock wires, plus the packages it resolves ELSEWHERE
-/// (an entry whose `resolved` is not a Socket reference) and the packages it
-/// installs BUNDLED (each purl → the first such entry's lock location).
+/// (an entry whose `resolved` is not a Socket reference), the packages it
+/// installs BUNDLED (each purl → the first such entry's lock location) and
+/// every `name@version` it has any entry for, at any path.
 struct NpmLockRefs {
     file: &'static str,
     refs: Vec<PatchedRef>,
     unwired: BTreeMap<String, String>,
     bundled: BTreeMap<String, String>,
+    mentioned: BTreeSet<String>,
+}
+
+impl NpmLockRefs {
+    /// Remember that this lock has an entry for `name@version`. An entry
+    /// without a version vouches for no version.
+    fn mention(&mut self, name: &str, version: Option<&str>) {
+        if let Some(purl) = version.and_then(|v| npm_purl(name, v)) {
+            self.mentioned.insert(purl);
+        }
+    }
+
+    /// Whether this lock has an entry for exactly `purl`'s `name@version`.
+    fn mentions(&self, purl: &str) -> bool {
+        self.mentioned.contains(purl)
+    }
 }
 
 /// Push every ref no OTHER npm lock contests. npm <= 11 installs from
@@ -89,9 +106,16 @@ struct NpmLockRefs {
 /// patched by some npm majors and unpatched by others — not decidable from
 /// the files, so it is diagnosed and not attested (the same call as the v2
 /// legacy mirror: a lock section some npm reads must not attest bytes
-/// another npm installs). The lock that does not mention the package at all
-/// contests nothing. Two locks wiring DIFFERENT patches are both emitted
-/// (the CLI's `wiring_conflict` gate).
+/// another npm installs). A lock with NO entry for the ref's
+/// `name@version` contests it too (#798): npm re-resolves a missing entry
+/// from the registry (npm 12 with a stale package-lock.json twin, npm <= 11
+/// with a stale shrinkwrap). An entry for another version holds only while
+/// that version still satisfies `package.json`, which the lock alone cannot
+/// tell, so a lock holding the package only at other versions (at any
+/// path) contests it as well. Twins the rewriters keep in sync share their
+/// `name@version` set and contest nothing. Two
+/// locks wiring DIFFERENT patches are both emitted (the CLI's
+/// `wiring_conflict` gate).
 ///
 /// A bundled copy of the ref's `name@version` in either lock contests it
 /// too, the same lock included (#325): the rewired entry and the bundled
@@ -159,6 +183,25 @@ fn push_uncontested(locks: Vec<NpmLockRefs>, out: &mut Discovery) {
                         lock.file, r.purl, r.uuid, other.file, NPM_LOCKS[0], NPM_LOCKS[1],
                     ),
                 );
+            } else if let Some(other) = locks
+                .iter()
+                .enumerate()
+                .find(|(j, other)| *j != i && !other.mentions(&r.purl))
+                .map(|(_, other)| other)
+            {
+                out.diag(
+                    DIAG_REF_UNATTRIBUTABLE,
+                    lock.file,
+                    format!(
+                        "{}: {} is wired to Socket patch {} but {} has no entry for the \
+                         package at that version, so npm can re-resolve it from the registry \
+                         when it installs from that lock — npm <= 11 installs from {}, npm >= 12 from {}, so \
+                         whether the patched bytes install depends on the npm version; \
+                         rewire both locks (re-run `socket-patch vendor` / `scan --mode \
+                         hosted`) to attest it",
+                        lock.file, r.purl, r.uuid, other.file, NPM_LOCKS[0], NPM_LOCKS[1],
+                    ),
+                );
             } else {
                 out.push(r.clone());
             }
@@ -180,6 +223,7 @@ async fn extract_package_lock(
         refs: Vec::new(),
         unwired: BTreeMap::new(),
         bundled: BTreeMap::new(),
+        mentioned: BTreeSet::new(),
     };
     let doc: Value = match parse_json(file, &bytes) {
         Ok(doc) => doc,
@@ -203,6 +247,7 @@ async fn extract_package_lock(
     // the same version, here ([`push_uncontested`]) and in any other lock
     // (the orchestrator).
     for (location, node) in npm_lock_bundled_nodes(&doc) {
+        read.mention(node.name, node.version);
         if let Some(purl) = node.version.and_then(|v| npm_purl(node.name, v)) {
             out.resolved_elsewhere(file, Some(purl.clone()));
             read.bundled.entry(purl).or_insert(location);
@@ -251,6 +296,7 @@ fn drop_non_registry_installs(
         else {
             continue;
         };
+        read.mentioned.insert(purl.clone());
         out.resolved_elsewhere(file, Some(purl.clone()));
         read.unwired
             .entry(purl.clone())
@@ -286,6 +332,7 @@ fn entry_ref(
     out: &mut Discovery,
 ) {
     let name = node.name;
+    read.mention(name, node.version);
     let resolved = node.resolved;
     let Located {
         vendored,
@@ -753,8 +800,10 @@ mod tests {
     }
 
     /// Both npm locks are read (npm 12 installs from package-lock.json beside a
-    /// committed shrinkwrap); a v2 lock's legacy `dependencies` mirror is
-    /// not (its agreeing twin adds nothing).
+    /// committed shrinkwrap), each yielding its own refs; a v2 lock's legacy
+    /// `dependencies` mirror is not (its agreeing twin adds nothing). The
+    /// twins agree: a lock with no entry for a package would contest it
+    /// (#798).
     #[tokio::test]
     async fn both_locks_are_read_and_the_agreeing_mirror_adds_nothing() {
         let a = hosted_url("npm", "left-pad", "1.3.0", UUID_A, "left-pad-1.3.0.tgz");
@@ -764,13 +813,15 @@ mod tests {
             "npm-shrinkwrap.json",
             lock_with_packages(serde_json::json!({
                 "node_modules/left-pad": { "version": "1.3.0", "resolved": a, "integrity": SRI },
+                "node_modules/minimist": { "version": "1.2.5", "resolved": b, "integrity": SRI },
             })),
         );
         p.write(
             "package-lock.json",
             serde_json::json!({
                 "lockfileVersion": 2,
                 "packages": {
+                    "node_modules/left-pad": { "version": "1.3.0", "resolved": a, "integrity": SRI },
                     "node_modules/minimist": { "version": "1.2.5", "resolved": b, "integrity": SRI },
                 },
                 "dependencies": {
@@ -796,8 +847,9 @@ mod tests {
         );
         assert_eq!(
             out.refs.len(),
-            2,
-            "the v2 mirror and its nested legacy copy add nothing: {:#?}",
+            4,
+            "one ref per package from each lock; the v2 mirror and its nested \
+             legacy copy add nothing: {:#?}",
             out.refs
         );
     }
@@ -863,7 +915,7 @@ mod tests {
 
     /// The agreeing dual-lock state (both locks wired identically — what the
     /// hosted rewriter and the vendor backend now write) is a ref from each
-    /// lock; a lock that does not mention the package contests nothing.
+    /// lock.
     #[tokio::test]
     async fn agreeing_dual_npm_locks_both_wire_the_patch() {
         let hosted = hosted_url("npm", "left-pad", "1.3.0", UUID_A, "left-pad-1.3.0.tgz");
@@ -882,6 +934,143 @@ mod tests {
         assert!(out.diagnostics.is_empty(), "{:?}", out.diagnostics);
     }
 
+    /// REGRESSION (#798): a twin npm lock with NO entry for the package
+    /// contests it too. npm 12 reads package-lock.json beside a committed
+    /// shrinkwrap and re-resolves the missing entry from the registry, so
+    /// the bytes it installs are unpatched, in either direction, hosted or
+    /// vendored. The uuids stay recognized (a ledger claim is dead too).
+    #[tokio::test]
+    async fn a_sibling_npm_lock_without_the_package_contests_it() {
+        let hosted = hosted_url("npm", "left-pad", "1.3.0", UUID_A, "left-pad-1.3.0.tgz");
+        let vendored = format!("file:.socket/vendor/npm/{UUID_B}/minimist-1.2.5.tgz");
+        let registry = |n: &str, v: &str| format!("https://registry.npmjs.org/{n}/-/{n}-{v}.tgz");
+        let p = Project::new();
+        // Shrinkwrap wires left-pad (hosted); package-lock has no left-pad.
+        // package-lock wires minimist (vendored); shrinkwrap has no minimist.
+        p.write(
+            "npm-shrinkwrap.json",
+            lock_with_packages(serde_json::json!({
+                "node_modules/left-pad": { "version": "1.3.0", "resolved": hosted, "integrity": SRI },
+                "node_modules/other": { "version": "1.0.0", "resolved": registry("other", "1.0.0"), "integrity": SRI },
+            })),
+        );
+        p.write(
+            "package-lock.json",
+            lock_with_packages(serde_json::json!({
+                "node_modules/minimist": { "version": "1.2.5", "resolved": vendored, "integrity": SRI },
+            })),
+        );
+        let out = run(&p).await;
+        assert!(
+            out.refs.is_empty(),
+            "contested refs emitted: {:#?}",
+            out.refs
+        );
+        let contested: Vec<&Diag> = out
+            .diagnostics
+            .iter()
+            .filter(|d| d.code == DIAG_REF_UNATTRIBUTABLE)
+            .collect();
+        assert_eq!(contested.len(), 2, "{:#?}", out.diagnostics);
+        assert!(contested
+            .iter()
+            .any(|d| d.file == std::path::Path::new("npm-shrinkwrap.json")
+                && d.detail.contains("pkg:npm/left-pad@1.3.0")
+                && d.detail.contains("no entry")
+                && d.detail.contains("npm >= 12")));
+        assert!(contested
+            .iter()
+            .any(|d| d.file == std::path::Path::new("package-lock.json")
+                && d.detail.contains("pkg:npm/minimist@1.2.5")
+                && d.detail.contains("no entry")));
+        for (label, uuid) in [("UUID_A", UUID_A), ("UUID_B", UUID_B)] {
+            assert!(
+                out.recognized.iter().any(|r| r.uuid == uuid),
+                "{label} must stay recognized (authoritative, dead): {:#?}",
+                out.recognized
+            );
+        }
+    }
+
+    /// REGRESSION (#798 review): a sibling npm lock holding the wired
+    /// package only at ANOTHER version contests it as well. npm keeps that
+    /// entry only while it satisfies `package.json` (`^1.3.0` here rejects
+    /// 1.2.0), and otherwise fetches the wired version unpatched from the
+    /// registry. Covers a top-level and a nested wired copy.
+    #[tokio::test]
+    async fn a_sibling_npm_lock_with_only_another_version_contests_it() {
+        let hosted = hosted_url("npm", "left-pad", "1.3.0", UUID_A, "left-pad-1.3.0.tgz");
+        let registry = |n: &str, v: &str| format!("https://registry.npmjs.org/{n}/-/{n}-{v}.tgz");
+        for wired_at in [
+            "node_modules/left-pad",
+            "node_modules/foo/node_modules/left-pad",
+        ] {
+            let p = Project::new();
+            p.write(
+                "package.json",
+                serde_json::json!({
+                    "name": "app", "version": "1.0.0",
+                    "dependencies": { "left-pad": "^1.3.0" },
+                })
+                .to_string(),
+            );
+            p.write(
+                "npm-shrinkwrap.json",
+                lock_with_packages(serde_json::json!({
+                    wired_at: { "version": "1.3.0", "resolved": hosted, "integrity": SRI },
+                })),
+            );
+            p.write(
+                "package-lock.json",
+                lock_with_packages(serde_json::json!({
+                    "node_modules/left-pad": { "version": "1.2.0", "resolved": registry("left-pad", "1.2.0"), "integrity": SRI },
+                })),
+            );
+            let out = run(&p).await;
+            assert!(out.refs.is_empty(), "{wired_at}: {:#?}", out.refs);
+            assert_eq!(
+                diag_codes(&out),
+                vec![DIAG_REF_UNATTRIBUTABLE],
+                "{wired_at}: {:#?}",
+                out.diagnostics
+            );
+            assert!(
+                out.diagnostics[0]
+                    .detail
+                    .contains("has no entry for the package at that version"),
+                "{:#?}",
+                out.diagnostics
+            );
+        }
+    }
+
+    /// The same `name@version` at a different path in the sibling lock
+    /// vouches for the wired one (the lock pair still agrees on what
+    /// installs).
+    #[tokio::test]
+    async fn a_sibling_npm_lock_with_the_version_at_another_path_contests_nothing() {
+        let hosted = hosted_url("npm", "left-pad", "1.3.0", UUID_A, "left-pad-1.3.0.tgz");
+        let p = Project::new();
+        p.write(
+            "npm-shrinkwrap.json",
+            lock_with_packages(serde_json::json!({
+                "node_modules/left-pad": { "version": "1.3.0", "resolved": hosted, "integrity": SRI },
+            })),
+        );
+        p.write(
+            "package-lock.json",
+            lock_with_packages(serde_json::json!({
+                "node_modules/foo/node_modules/left-pad": { "version": "1.3.0", "resolved": hosted, "integrity": SRI },
+            })),
+        );
+        let out = run(&p).await;
+        assert_refs(
+            &out,
+            &[("pkg:npm/left-pad@1.3.0", UUID_A, WiringMode::Hosted)],
+        );
+        assert!(out.diagnostics.is_empty(), "{:?}", out.diagnostics);
+    }
+
     /// REGRESSION: a v2 lock whose `packages` entry was reverted to the
     /// registry while its stale legacy `dependencies` mirror still carries
     /// the Socket url wires NOTHING — npm >= 7 installs from `packages`, so
 
@@ -51,7 +51,10 @@ npm 12 notes:
   both present, npm 12 installs from package-lock.json while npm <= 11 installs
   from the shrinkwrap — so hosted and vendored rewrites wire BOTH, and
   manifest-less VEX refuses to attest a package one lock wires while the other
-  still resolves it from the registry (`patched_ref_unattributable`).
+  still resolves it from the registry or has no entry for that `name@version`
+  (missing, or only another version that may no longer satisfy
+  `package.json`), which npm can re-resolve from the registry
+  (`patched_ref_unattributable`).
 - `allow-file` defaults to `all`: vendored `file:` tarballs install unchanged.
 
 ## Suites