I made something new: an eslint plugin to validate your npm ecosystem lockfiles! It supports npm, pnpm, yarn, bun, and vlt, and it's already helped find a supply chain security attack vector inside a fortune 500 tech company. https://www.npmjs.com/package/eslint-plugin-lockfile
You can also run the eslint rule as a standalone CLI! `npx lintlock` / https://www.npmjs.com/package/lintlock
(all written in ESM, all with minimal deps, all supporting only modern node, for those that care about that sort of thing)
