lockfile-lint
A security linter for npm and yarn lockfiles to detect malicious package injections and enforce trust policies.
What is lockfile-lint?
lockfile-lint is a security-focused linting tool for npm and yarn lockfiles that detects malicious package injections and enforces trust policies. It solves the problem of attackers sneaking harmful resources into lockfiles during code changes, which can compromise the software supply chain. By validating allowed hosts and enforcing HTTPS, it helps maintain the integrity of dependencies.
Node.js developers, security engineers, and DevOps teams who manage JavaScript projects with npm or yarn and want to secure their dependency lockfiles against tampering.
Developers choose lockfile-lint because it specifically addresses lockfile poisoning attacks, a vector not covered by tools like npm audit. Its policy-based approach and easy integration into CI/CD pipelines provide proactive security for dependency management.
Overview
Lint an npm or yarn lockfile to analyze and detect security issues
Use Cases
Best For
- Securing npm or yarn lockfiles in CI/CD pipelines
Related Projects
Found a gem we're missing?
Open-Awesome is built by the community, for the community. Submit a project, suggest an awesome list, or help improve the catalog on GitHub.
