A security linter for npm and yarn lockfiles to detect malicious package injections and enforce trust policies.
lockfile-lint is a security-focused linting tool for npm and yarn lockfiles that detects malicious package injections and enforces trust policies. It solves the problem of attackers sneaking harmful resources into lockfiles during code changes, which can compromise the software supply chain. By validating allowed hosts and enforcing HTTPS, it helps maintain the integrity of dependencies.
Node.js developers, security engineers, and DevOps teams who manage JavaScript projects with npm or yarn and want to secure their dependency lockfiles against tampering.
Developers choose lockfile-lint because it specifically addresses lockfile poisoning attacks, a vector not covered by tools like npm audit. Its policy-based approach and easy integration into CI/CD pipelines provide proactive security for dependency management.
Lint an npm or yarn lockfile to analyze and detect security issues
Open-Awesome is built by the community, for the community. Submit a project, suggest an awesome list, or help improve the catalog on GitHub.
Ensures all packages in the lockfile originate from allowed, trusted registries like npm or yarn, directly preventing malicious source injections as described in the README's security use case.
Validates that every package resource URL uses HTTPS, enhancing security by preventing man-in-the-middle attacks during dependency fetching, shown in CLI examples with --validate-https.
Can be easily run as a CLI tool in pre-commit hooks or continuous integration pipelines, with simple npx commands demonstrated in the README for automated workflows.
Specifically addresses lockfile poisoning attacks, a blindspot not covered by tools like npm audit, as highlighted in the FAQ comparing it to npm audit.
The FAQ admits pnpm support is minimal, as pnpm's lockfile structure is less prone to injection, making the tool ineffective for pnpm-lock.yaml validation without additional workarounds.
Security disclaimer notes that whitelisting hosts like npmjs implies trust in all packages from those sources, so malicious packages within trusted registries are not detected, relying on external vetting.
Only validates lockfile integrity; it does not scan for vulnerabilities or audit package contents, requiring complementary tools like npm audit for full dependency security, as acknowledged in the README.