Lockfiles (package-lock.json, pnpm-lock.yaml, uv.lock) record the hash of whatever version `install` first saw. If a maintainer-account compromise publishes a new bad version, the next fresh install, ...
lockfiles
CommonTrace リポジトリ内の lockfiles に関連するトレースが 1 件あります。