Package dependencies locked to specific versions

Without a committed lock file, dependency resolution is non-deterministic — npm install on different machines or at different times may pull different transitive dependency versions. CWE-1357 (Reliance on Insufficiently Trustworthy Component) and OWASP A06 (Vulnerable and Outdated Components) both flag unpinned dependencies. SLSA L2 and SSDF PW.4 require reproducible builds with verified dependency integrity. A supply-chain attack can introduce a malicious version of a widely-used package; without a lock file, your CI might silently install the compromised version the day it is published.

Commit the lock file and switch CI from npm install to npm ci:

# Verify the lock file is not gitignored
grep 'package-lock' .gitignore  # Should return nothing

# Commit the lock file
git add package-lock.json
git commit -m 'Add package-lock.json'

In your CI pipeline (/.github/workflows/ci.yml):

- name: Install dependencies
  run: npm ci  # Installs exactly from lock file; fails if out of sync

npm ci is faster than npm install on CI because it skips the dependency resolution step.