Skip to content
Lint an npm or yarn lockfile to analyze and detect security issues
JavaScript
Branch: master
Clone or download
Fetching latest commit…
Cannot retrieve the latest commit at this time.
Permalink
Type Name Latest commit message Commit time
Failed to load latest commit information.
.github
packages chore(deps): upgrade debug from 4.1.1 to 4.1.1 (#33) Dec 7, 2019
.gitignore initial commit Jun 2, 2019
.prettierrc.js initial commit Jun 2, 2019
.travis.yml build(node12): test on Node.js 12 (#7) Aug 1, 2019
CODE_OF_CONDUCT.md initial commit Jun 2, 2019
CONTRIBUTING.md
LICENSE initial commit Jun 2, 2019
README.md docs(usage): update usage instructions Oct 12, 2019
lerna.json
package.json chore(eslint): lint on commit and fix staged prettier changes Jun 18, 2019
yarn.lock feat(lockfile-lint): 🎉 cli tool initial version Jun 18, 2019

README.md

lockfile linting 🌈

lint lockfiles for improved security and trust policies

build codecov license Security Responsible Disclosure npx lockfile-lint

About

Lockfiles are used as trusted whitelist of resources manifest to fetch packages from. However, keeping track of the changes introduced to lockfiles is not an easy task as they are designed to consumed by machines 🤖.

What happens when someone creates a Pull Request and sneaks a malicious resource package that replaces a real library? 😱

Exactly! Lint your lockfiles to ensure they adhere to pre-defined security policies and mitigate this vector of attack.

Usage

Easily invoked with npx on any project and lint it:

npx lockfile-lint --path yarn.lock --allowed-hosts npm yarn --validate-https

If lockfile-lint detects exceptions to the policies it will report them:

carbon

Refer to lockfile-lint for more details on the CLI usage.

You can use lockfile-lint as a standalone CLI tool, or as an API library using the following npm packages:

  • lockfile-lint - a CLI tool that can be easily integrated as a pre-commit hook or part of a CI/build
  • lockfile-lint-api - a library providing a programmatic API

Author

lockfile-lint © Liran Tal, Released under the Apache-2.0 License.

You can’t perform that action at this time.