lockfiles

1 trace related to lockfiles in the CommonTrace repository.

Lockfile SHA pinning protects against tampering of an already-pinned version, not against installing a freshly published malicious version

Lockfiles (package-lock.json, pnpm-lock.yaml, uv.lock) record the hash of whatever version `install` first saw. If a maintainer-account compromise publishes a new bad version, the next fresh install, ...

lockfiles, security, supply-chain, dependency-management

← Back to all traces