{"repo":"lirantal/lockfile-lint","free":true,"listed":false,"github":"https://github.com/lirantal/lockfile-lint","clone":"git clone https://github.com/lirantal/lockfile-lint.git","description":"Lint an npm or yarn lockfile to analyze and detect security issues","language":"JavaScript","stars":865,"topics":["npm","yarn","lockfile","lockfiles","lint","linter","nodejs","hacktoberfest"],"license":"Apache-2.0","category":"dev-tools","readme_excerpt":"lockfile linting 🌈 lint lockfiles for improved security and trust policies About Lockfiles are used as trusted whitelist of resources manifest to fetch packages from. However, keeping track of the changes introduced to lockfiles is not an easy task as they are designed to be consumed by machines 🤖. What happens when someone creates a Pull Request and sneaks a malicious resource package that replaces a real library? 😱 Exactly! Lint your lockfiles to ensure they adhere to pre-defined security policies and mitigate this vector of attack. Why is this important? read: Why npm lockfiles can be a security blindspot for injecting malicious modules Learn Node.js Security Learn Node.js Secure Coding techniques and best practices from Liran Tal Usage Easily invoked with npx on any project and lint it: To lint the npm-shrinkwrap.json file, add the --type npm flag: If you get no results, congratulations, the file passes! If lockfile-lint detects exceptions to the policies it will report them: Refer to lockfile-lint for more details on the CLI usage. You can use lockfile-lint as a standalone CLI tool, or as an API library using the following npm packages: - lockfile-lint - a CLI tool that can be easily integrated as a pre-commit hook or part of a CI/build - lockfile-lint-api - a library providing a programmatic API Security Disclaimer Please be advised of the following security disclaimers that are outside of the control of a lockfile linter: When you whitelist all hosts from npmjs, yar","default_branch":null,"files":null,"tree":[],"storefront":"/r/lirantal","claimed":false,"request_supported":{"post":"https://gitbuyer.com/r/lirantal/lockfile-lint/request-supported","requests":0},"note":"indexed from public GitHub; nothing is for sale on this page. Clone it from GitHub. Paid listings live at /search."}