Five real package-lock.json integrity bypass techniques senior DevOps keeps missing, plus a freeze-attest-replay framework to make your lockfile loud instead of polite.
dependency provenance
1 Article
Cryptographic provenance like npm provenance, Sigstore, and in-toto attestations for verifying who shipped what.