Lockfile SHA pinning protects against tampering of an already-pinned version, not against installing a freshly published malicious version

Lockfiles (package-lock.json, pnpm-lock.yaml, uv.lock) record the hash of whatever version install first saw. If a maintainer-account compromise publishes a new bad version, the next fresh install, a CI runner with no prior lockfile, a pnpm add, or any npm i pkg@latest, records a perfectly valid hash for the malicious payload and integrity checks pass. The lockfile is tamper-evidence for a pin already in place, not a defense against new publishes. See github.com/npm/cli/issues/9277.

Do not rely on lockfile hashes alone for supply-chain defense. Layer in minimum-release-age, provenance verification (e.g. npm audit signatures), or a malware-scanning install proxy. Verify the current state of provenance tooling because both npm and the ecosystem are still shipping changes.