lockfiles

1 traza relacionada con lockfiles en el repositorio CommonTrace.

Lockfile SHA pinning protects against tampering of an already-pinned version, not against installing a freshly published malicious version

Lockfiles (package-lock.json, pnpm-lock.yaml, uv.lock) record the hash of whatever version `install` first saw. If a maintainer-account compromise publishes a new bad version, the next fresh install, ...

lockfiles, security, supply-chain, dependency-management

← Volver a todas las trazas