Unverified50% confidenceFactExact time

锁文件记录依赖树中每个包的精确版本号和完整性哈希，是防止自动升级到恶意版本的第一道防线

1

Sources

50%

Confidence

Long-term

Relevance

8/7/2026

First Seen

Sources

Shai-Hulud Supply Chain Attack: In-Depth Analysis of the Keyv npm Package Compromise and Defense Guide

Related Claims

UnverifiedStarting from v7, npm enabled strict mode for package-lock.json by default, which can lock the exact version and integrity hash of every package in the dependency tree.66% similar

Cite This Claim

Stable URI

https://kongchang.com/claim/704142

API

curl https://kongchang.com/api/v1/knowledge/claims/704142

MCP

get_claim(id=704142)