lockfile-lint

lockfile-lint is a CLI tool for linting npm and Yarn lockfiles against security policies. Current stable version is 5.0.0 (requires Node >=16), with frequent patch releases. It validates package origins, HTTPS usage, allowed hosts/schemes, and integrates into CI pipelines. Unlike generic linters, it focuses on supply-chain security by enforcing policies on lockfile entries. Maintained by Liran Tal and part of the lockfile-lint project.