NPM lockfiles can be a security blindspot for injecting malicious modules in PRs
Wait, you're supposed to commit those? Genuinely curious.<p>I always set up an ignore rule for them and use package.json's dependency list instead. My projects are all on the small side though; is the idea to commit the .lock file and avoid breakage through things like minor version updates of your first level dependencies? Wouldn't that carry a bigger security risk for large numbers of packages that then aren't receiving patch updates as readily?