Lockfile committed to repo

A missing lockfile means npm install resolves dependency versions at install time rather than pinning them. Two developers on the same project — or the same developer on two machines — can get different dependency trees. CWE-1357 and SLSA L1 both identify non-deterministic builds as a supply-chain risk: a transitive dependency can silently introduce a breaking change or a security regression between developer and CI, making bugs impossible to reproduce. SSDF SP 800-218 PW.4.1 requires reproducible builds as a baseline software security practice.

Run your package manager's install command to generate the lockfile, then commit it and keep it committed. Remove the lockfile from .gitignore if it appears there.

npm install          # generates package-lock.json
git add package-lock.json
git commit -m "chore: add lockfile for reproducible installs"

In CI, always use npm ci instead of npm install — npm ci installs exactly from the lockfile and errors if it diverges from package.json. For Yarn or pnpm, use --frozen-lockfile.