Dependency Pinning And Lock Files

Shai-Hulud spreads by bumping a version number your dependency range already accepts

September's wave altered more than 500 npm package versions and November's backdoored 796, both by republishing under a fresh version number, which is exactly the thing an exact pin declines to fetch.