One accepted semantic defect in lockfile-pin-delta.

Reward

0.10 USDC on Base. TOTAL one reward 0.10. No entry fee. No wallet required to submit.

Who is paid

First accepted unique qualifying issue. Duplicates are not paid.

How paid

Neomorphic-sponsored, maintainer-reviewed, manual. Not automated. Not escrow. Not customer revenue.

After acceptance

The contributor may send a Base USDC destination through safe contact. Never a seed phrase.

Accounts

Filing a GitHub issue may require a GitHub account. Neomorphic does not use OAuth.

Merchant package x402-merchant 1.23.47. Engine path vendor/lockfile-pin-delta on the public extractor repository.

Working directory that already contains before.json and after.json (npm lockfile v2/v3). The clone is created as a subdirectory of that directory.

git clone https://github.com/epistemedeus/x402-url-extractor && git -C x402-url-extractor checkout ca38205279f0d543515b81b7261909e55ea2600f && node x402-url-extractor/vendor/lockfile-pin-delta/bin/lockfile-delta.mjs --before before.json --after after.json --out-dir pin-delta-out

From an empty directory, with no GitHub token:

curl -fsSL https://neomorphic.io/downloads/n-bty-003/n-bty-003-kit-0.1.0.tar.gz -o n-bty-003-kit-0.1.0.tar.gz && curl -fsSL https://neomorphic.io/downloads/n-bty-003/SHA256SUMS -o SHA256SUMS && sha256sum -c SHA256SUMS && tar -xzf n-bty-003-kit-0.1.0.tar.gz && node n-bty-003-kit-0.1.0/reproduce.mjs n-bty-003-kit-0.1.0/fixtures/owner-fixture.json

The included owner fixture is a practice example and prints paidClaim: false. Use it to learn the envelope format, then provide your own qualifying reproduction. Digest files live beside the archive.

• npm package-lock.json lockfileVersion 2 or 3 JSON pairs
• Claimed incorrect pin-delta vs expected pin-delta grounded in lock semantics
• Reproduction with the genuine local engine at the pin

Out of scope: CVE or security-exploit rewards; Private data or secrets; Unbounded fuzz or load; Executing submitted code; Known supported refusals (HTML, package.json-only, unsupported lockfileVersion); Mere feature requests; Existing tracked duplicates.

Schema neomorphic.n-bty-003.reproduction-claim.v1. Inline beforeLockfile and afterLockfile objects. observed and expected are full pin-delta projections (schema, status, counts, and identity-qualified added/removed/changed pins, not counts alone). Plus semanticDefect, engine commit, reproduction command. No URLs to fetch. No reporter code.

Neomorphic-sponsored 0.10 USDC on Base for one accepted unique qualifying defect. TOTAL one reward 0.10. No entry fee. No wallet required to submit. Maintainer review and manual payout. Not automated. Not escrow. Not customer revenue.