[vel0city]

The package-lock.json includes a hash of the package, not just a version number which should be immutable.

[whilenot-dev]

To add to this: the hash in the lock file is the checksum of the published tarball, not the commit hash.

[cluckindan]

And then someone runs `npm install` on their CI