NPM lockfiles can be a security blindspot for injecting malicious modules in PRs
Wait, you're supposed to commit those? Genuinely curious.I always set up an ignore rule for them and use package.json's dependency list instead. My projects are all on the small side though; is the idea to commit the .lock file and avoid breakage through things like minor version updates of your first level dependencies? Wouldn't that carry a bigger security risk for large numbers of packages that then aren't receiving patch updates as readily?