lockfile-lint

library5.0.0jsnpmunverified

lockfile-lint is a CLI tool for linting npm and Yarn lockfiles against security policies. Current stable version is 5.0.0 (requires Node >=16), with frequent patch releases. It validates package origins, HTTPS usage, allowed hosts/schemes, and integrates into CI pipelines. Unlike generic linters, it focuses on supply-chain security by enforcing policies on lockfile entries. Maintained by Liran Tal and part of the lockfile-lint project.

devops testing auth-security

npm install lockfile-lint

github ↗package ↗homepage ↗

INSTALL

IMPORT

SIG · LOCKFILE-LINT

lockfile-lint

devopsjavascriptv5.0.0

Install

—

Import

—

Disk

—

Pass rate

0/ 6

Env Coverage0 / 6

glibc

18–22

musl

18–22

Install & Compatibility

Where this runs

tested against v? · npm install

Install × environment matrix

Each cell = how many times install + import succeeded across repeated harness runs. Partial = flaky.
glibc = Debian/Ubuntu slim · musl = Alpine Linux

musl

node 18–226 runs

build_error

glibc

node 18–226 runs

build_error

Code

Verified usage

Verified import paths — ran on the pinned version, not inferred.

default

✓ import lockfileLint from 'lockfile-lint'

✗ const lockfileLint = require('lockfile-lint')

ESM-only since v5; use dynamic import for CommonJS.

lockfileLint

✓ import { lockfileLint } from 'lockfile-lint'

✗ const { lockfileLint } = require('lockfile-lint')

ESM default export also available as named export.

LockfileLintConfig

✓ import type { LockfileLintConfig } from 'lockfile-lint'

Type only, requires TypeScript; not available in CJS.

Shows programmatic usage with validation of HTTPS and allowed hosts for npm lockfile.

// Install: npm install --save-dev lockfile-lint // Run in CI or locally: import lockfileLint from 'lockfile-lint'; const result = lockfileLint({ type: 'npm', path: './package-lock.json', validateHttps: true, allowedHosts: ['registry.npmjs.org'] }); console.log(result?.message); // Or CLI: // npx lockfile-lint --type npm --path package-lock.json --validate-https --allowed-hosts registry.npmjs.org

lockfile-lint --version

Debug

Known issues

breakingv5.0.0 dropped CommonJS support; use ESM imports only.

fix

Convert require() to import or use dynamic import().

affects: >=5.0.0

gotcha--allowed-schemes and --validate-https are mutually exclusive.

fix

Use either --allowed-schemes with specific schemes or --validate-https alone.

affects: *

gotcha--allowed-urls overrides --allowed-hosts for specific URLs.

fix

Ensure policy clarity: if a URL matches --allowed-urls, it bypasses host validation.

affects: *

deprecatedNode <16 support dropped in v5.

fix

Upgrade Node to >=16.

affects: >=5.0.0

gotchaLockfile type detection may fail for unusual filenames.

fix

Always specify --type (yarn or npm) explicitly.

affects: *

Errors

Common errors & fixes

Error: lockfile-lint: --version command-line was throwing an error related to glob matching

Bug in v4.12.0 with glob patterns in version flag.

fix

Upgrade to v4.12.1 or later.

TypeError: lockfileLint is not a function

Using CommonJS require() with ESM-only version.

fix

Use import lockfileLint from 'lockfile-lint' or dynamic import().

Error: lockfile-lint: --allowed-schemes and --validate-https cannot be used together

Mutually exclusive options.

fix

Choose one: either --allowed-schemes or --validate-https.

Error: lockfile-lint: --type must be 'npm' or 'yarn'

Invalid lockfile type provided.

fix

Use --type npm or --type yarn (or omit for auto-detection).

Upgrade

Version history

5.0.0latest on npm

Audit

Dependencies

lockfile-lint-apirequiredprovides the core validation logic

Agent activity

7 hits · last 30 days

node

OpenAI (training)

Resources

githubhttps://github.com/lirantal/lockfile-lint ↗

packagehttps://www.npmjs.com/package/lockfile-lint ↗

homepagehttps://lockfile-lint.dev ↗