Comment on You too can run malware from NPM (I mean without consequences)parentComments−vel0city1yThe package-lock.json includes a hash of the package, not just a version number which should be immutable.−whilenot-dev1yTo add to this: the hash in the lock file is the checksum of the published tarball, not the commit hash.−cluckindan1yAnd then someone runs `npm install` on their CI
Comments
The package-lock.json includes a hash of the package, not just a version number which should be immutable.
To add to this: the hash in the lock file is the checksum of the published tarball, not the commit hash.
And then someone runs `npm install` on their CI