Missing or Ignored Dependency Lockfile
Overview
Lockfiles (package-lock.json, yarn.lock, Pipfile.lock, go.sum, Gemfile.lock) pin exact dependency versions. Without them, npm install may install newer versions that introduce vulnerabilities or malicious code.
Gitignoring lockfiles in application projects is a security anti-pattern.
Remediation
- Commit lockfiles to version control for all application projects
- Use
npm ciinstead ofnpm installin CI/CD - Verify lockfile integrity in CI with
--frozen-lockfile