I made something new: an eslint plugin to validate your npm ecosystem lockfiles! It supports npm, pnpm, yarn, bun, and vlt, and it's already helped find a supply chain security attack vector inside a fortune 500 tech company. npmjs.com/package/eslint-plugi

You can also run the eslint rule as a standalone CLI! `npx lintlock` / npmjs.com/package/lintlock

(all written in ESM, all with minimal deps, all supporting only modern node, for those that care about that sort of thing)

0

If you have a fediverse account, you can quote this note from your own instance. Search https://mastodon.social/users/ljharb/statuses/115761993022112497 on your instance and quote it. (Note that quoting is not supported in Mastodon.)