Five real package-lock.json integrity bypass techniques senior DevOps keeps missing, plus a freeze-attest-replay framework to make your lockfile loud instead of polite.
registry pinning
1 Article
Pinning registries per scope in .npmrc, denying unknown registry traffic, and using hardening proxies.