Socket Cli not able to find npm when running through volta

[broksonic21]

We use volta, and in socket (v1.1.25 at least), we are getting errors finding npm when running npx socket fix --id followed by a GHSA id on this repository

Volta: https://volta.sh/

After installing volta, you can repro this via: volta pin node; volta pin npm@10.9.4

Folder looks like this:

(main ✔) which npm
/Users/REDACTED/.volta/bin/npm

Example:

✔ Received Socket API response (after requesting supported scan file types).
✔ Received Socket API response (after requesting upload manifests).
ℹ Running in local mode - fixes will be applied directly to your working directory.
Missing environment variables for PR creation: CI
✖ Unable to find npm CLI install directory.
Searched parent directories of /Users/REDACTED/.volta/tools/image/npm/10.9.4/bin.

This is may be a bug with socket-npm related to changes to the npm CLI.
Please report to https://github.com/SocketDev/socket-cli/issues.

[jdalton]

@broksonic21 Have you tried with the Socket Firewall?

npm i -g sfw
sfw npm install <...>

We will be transitioning the Socket safe-npm to Socket Firewall in the coming days.