Registry / devops / lockfile-lint-api

lockfile-lint-api

library5.9.2jsnpmunverified

Programmatic API for linting npm or yarn lockfiles to detect security and policy issues. Current stable version is 5.9.2, released as part of the lockfile-lint monorepo. It provides validators for HTTPS scheme, allowed hosts, package name consistency, URI schemes, and integrity hash types. Outputs structured success/error objects. Requires Node >=16.0.0.

devops auth-security

npm install lockfile-lint-api

github ↗package ↗homepage ↗

INSTALL

IMPORT

SIG · LOCKFILE-LINT-API

lockfile-lint-api

devopsjavascriptv5.9.2

harness data pending

Install & Compatibility

Where this runs

No compatibility data collected yet for this library.

Code

Verified usage

Verified import paths — ran on the pinned version, not inferred.

ValidateHost

✓ import { ValidateHost } from 'lockfile-lint-api'

✗ const { ValidateHost } = require('lockfile-lint-api')

ESM imports are supported; CommonJS require also works.

ValidateHttps

✓ import { ValidateHttps } from 'lockfile-lint-api'

✗ import ValidateHttps from 'lockfile-lint-api'

ValidateHttps is a named export, not default.

ParseLockfile

✓ import { ParseLockfile } from 'lockfile-lint-api'

Used to parse lockfile content before validation.

Parses a package-lock.json file and validates that all packages are hosted on the allowed 'npm' host.

import { ParseLockfile, ValidateHost } from 'lockfile-lint-api'; import fs from 'fs'; const lockfilePath = 'package-lock.json'; const lockfileContent = fs.readFileSync(lockfilePath, 'utf8'); const parser = new ParseLockfile(lockfileContent); const lockfile = parser.parse(); const validator = new ValidateHost({ packages: lockfile.object }); try { const result = validator.validate(['npm']); console.log(result.type === 'success' ? 'Valid' : 'Invalid'); } catch (err) { console.error('Validation error:', err.message); }

Debug

Known issues

breakingRequires Node >=16.0.0 as of version 5.0.0

fix

Upgrade Node.js to version 16 or later.

affects: >=5.0.0

deprecatedThe 'ValidateScheme' validator is being deprecated in favor of 'ValidateHttps'

fix

Use ValidateHttps instead of ValidateScheme.

affects: >=5.0.0

gotchaValidators skip packages without a 'resolved' field (e.g., local filesystem packages).

fix

Ensure packages have a 'resolved' field if you want them validated.

affects: *

Errors

Common errors & fixes

Error: Cannot find module 'lockfile-lint-api'

Package not installed or incorrect import path.

fix

Run 'npm install lockfile-lint-api' and ensure import path is correct.

TypeError: validator.validate is not a function

Using an invalid validator object or method name.

fix

Check that you instantiated the validator correctly and are calling the appropriate method (e.g., validator.validate()).

Upgrade

Version history

5.9.2latest on npm

Audit

Dependencies

No dependency data recorded yet.

Agent activity

9 hits · last 30 days

node

OpenAI (training)

Resources

githubhttps://github.com/lirantal/lockfile-lint ↗

packagehttps://www.npmjs.com/package/lockfile-lint-api ↗

homepagehttps://lockfile-lint.com ↗