lockfile-lint VS npq

Run static analysis e.g. lint with lockfile-lint, Stylelint, ESLint, check for unimported files using unimported, and identify potential security vulnerabilities

I built a lockfile-lint (https://github.com/lirantal/lockfile-lint) that helps with ensuring that some of these trust policies are enforced.

And it is happening right now. Github is opening the GitHub Advisory Database to community submissions. Awesome community NodeSecure builds cool things like scanner and js-x-ray. There are also lockfile-lint, LavaMoat, Jfrog-npm-tools (and I am sure there is more).

An additional approach may be to use lockfile-lint, but you shouldn't just rely on this script entirely because there are other ecosystems than npm, and they may have similar issues.

Use lockfile lint to check changes in the package-lock.json which is typically not reviewed

You might also want to look at npq which is an open source project that helps you proactively defend against potentially bad (malicious) npm packages before installing them.

You just described my project called npq: https://github.com/lirantal/npq :-)

That's pretty cool. I was just recently publishing about Ruby gem lockfile injection attacks (read here: https://snyk.io/blog/ruby-gem-installation-lockfile-injection-attacks/). I also wrote something related to this for npm users, but not a sandbox, called npq: https://github.com/lirantal/npq/

In any case, proactively protecting against is indeed the more difficult thing to do, but also the rarer and sort of 0 day vulnerabilities that happen. That said, I built a module called npq (see here https://github.com/lirantal/npq/) that helps me, and others, countermeasure against these sort of malicious incidents. In light of recent malicious incidents, it calls for updating some of the capabilities there (referred to as marshalls)