lockfile-lint concerns with package.lock

README.md

How to reproduce

1. Use only the package.json manifest
2. Run npm install
3. Check /tmp/world.txt (should be empty)
4. Update the package-lock.json file with the one provided in this gist
5. Run rm -rf node_modules/ && npm install (notice how it's necessary in this vector to remove the node_modules/ folder)
6. Confirm /tmp/world.txt is now created on the filesystem

References

1. https://snyk.io/blog/why-npm-lockfiles-can-be-a-security-blindspot-for-injecting-malicious-modules/
2. https://github.com/lirantal/lockfile-lint

package-lock.json

{
  "name": "lla",
  "version": "1.0.0",
  "lockfileVersion": 1,
  "requires": true,
  "dependencies": {
    "ms": {
      "version": "2.1.1",
      "resolved": "https://github.com/lirantal/ms/tarball/master",
      "integrity": "sha512-DlpjtaUS9RFy3q9oagI6RWUkIIk8UOJ+ZwxqlZ+y3sKvk3n93nD9gL/Nw06xI5i8YTqT9Q5znTs6HzVZO9BjDQ=="
    },
    "signal-exit": {
      "version": "3.0.2",
      "resolved": "https://registry.npmjs.org/signal-exit/-/signal-exit-3.0.2.tgz",
      "integrity": "sha1-tf3AjxKH6hF4Yo5BXiUTK3NkbG0="
    }
  }
}

package.json

{
  "name": "lla",
  "version": "1.0.0",
  "description": "",
  "main": "index.js",
  "scripts": {
    "test": "echo \"Error: no test specified\" && exit 1"
  },
  "keywords": [],
  "author": "",
  "license": "ISC",
  "dependencies": {
    "ms": "^2.1.1",
    "signal-exit": "^3.0.2"
  }
}