Lock file is committed and current

Without a committed lock file, every npm install — on your machine, in CI, and at deploy time — is a fresh resolution against whatever versions are current on the registry at that moment. A transitive dependency can silently update between your local install and the production deploy, introducing a behavioral change or a newly-published vulnerability without any visible diff. SLSA L2 requires that the build process be reproducible from a pinned source; a missing lock file breaks that invariant. CWE-829 (Inclusion of Functionality from Untrusted Control Sphere) applies because the install is pulling code from a source you haven't reviewed at that exact version. Lock files are the minimum viable proof that what you shipped is what you tested.

Generate and commit the lock file immediately. Remove it from .gitignore if present — there is no valid reason to exclude a lock file from an application repository.

npm install
git add package-lock.json
git commit -m "chore: add package lock file"

For monorepos or workspaces, commit the root lock file. For pnpm or yarn, commit pnpm-lock.yaml or yarn.lock respectively. CI should run npm ci (not npm install) to enforce the lock file on every build.