A lockfile change nobody reads
A pull request says “bump axios” but also touches package-lock.json. Diff the lockfiles and find the package whose download URL and integrity hash were quietly swapped.
Briefing
Reviewers skim lockfile diffs because they are long and machine-written. That makes them a good place to hide a change: npm installs exactly what the lockfile’s resolved URL points to.
You have the lockfile from main and the one from the pull request in review/.
dev-laptop · Supply chain
Type help for the command list and objectives for your tasks. Everything runs in this browser.
Up and down arrows walk your history. Ctrl+L clears the screen. Try help, ls, and objectives.