I'd say what you should depends a lot on information that you aren't providing. What does your $WORK do with external bug reports? What does $WORK do with internal bug reports? How does $WORK appreciate internal bug reports that actually don't affect $WORK? Who's maintaining $WORK module? Is the CPAN version the same as the $WORK version? Can you just fix the bug and check in the code? Can you just walk up to the desk of the person who made the module and ask her/him to fix it?