Lesson 4.8: Reviewing dependencies through the lockfile
A modern web front end ships hundreds of packages written by strangers, and npm runs their install scripts on developer laptops and CI servers. The lockfile records exactly which version of every package is installed and where it came from, which makes it the best place to review a change. In the lab you review pull request #418 of Northwind's shop front end: a package from an unknown registry with an install script, two known vulnerabilities from npm audit, and you write the policy and review decision that stop it.
16 min
You will learn to
- Explain lockfiles and why they matter
- Find packages from unexpected registries
- Find packages with install scripts
- Read npm audit JSON
- Write a dependency policy (.npmrc, npm ci)
Key terms
- Lockfile
- A file recording the exact version, source and hash of every installed package.
- Transitive dependency
- A package you didn't choose, pulled in by one you did.
- Install script
- Code a package runs during installation (preinstall, install, postinstall).
- npm ci
- Clean install exactly from the lockfile; fails if package.json and lockfile disagree.
- npm audit
- Checks installed versions against published security advisories.
- Typosquatting / dependency confusion
- Malicious packages with look-alike names / public packages that shadow internal ones.
← Broken access control and IDOR · All lessons · Tiering: where admins may log on →