Package lock file is committed

Without a committed lock file, every deployment resolves dependency versions fresh from the registry. A package that satisfies ^1.2.3 today might resolve to 1.9.0 tomorrow after the maintainer pushes a new version — and if that version contains malicious code (as happened with ua-parser-js, colors, and event-stream), your production deployment installs it silently. OWASP A08 (Software and Data Integrity Failures) covers this class of dependency confusion. SLSA Level 1 requires pinned dependency declarations; SSDF PW.4.4 requires reproducible builds. CWE-829 (Inclusion of Functionality from Untrusted Control Sphere) maps to the scenario where a registry compromise affects your build.

Generate a lock file with your package manager and commit it to the repository. Never add lock files to .gitignore.

# Generate (use whichever matches your package manager)
npm install     # creates package-lock.json
pnpm install    # creates pnpm-lock.yaml
yarn install    # creates yarn.lock
bun install     # creates bun.lockb

Commit the lock file: git add package-lock.json && git commit -m 'chore: add lock file'. In CI, use npm ci instead of npm install — ci enforces the lock file and fails if it's out of sync with package.json.