Monorepo: Lockfile security

[evertonfraga]

NPM is currently the sole responsible for checking the integrity of the packages. But in the case of a malicious package-lock.json being introduced, npm has limited reach.

So for a start, we should aim to never accept package-lock.json changes from external PRs.

For every other case, we should Lockfile-lint.

Thanks for bringing this up, @holgerd77.

[holgerd77]

I guess this is still relevant.

[ryanio]

nice, maybe can run this script as a preinstall script on the root package.json? e.g.:

"preinstall": "npm run lintLockfile",
"lintLockfile": "npx lockfile-lint --path package-lock.json --allowed-hosts npm --validate-https"

[jochem-brouwer]

Is this addressed in https://github.com/ethereumjs/ethereumjs-monorepo/pull/2201 ? CC @faustbrian

[faustbrian]

Would say so @jochem-brouwer and rejecting such PRs should be up to the reviewer

[jochem-brouwer]

OK, will close.