What is a lockfile?
Updated
A lockfile is a file, such as package-lock.json, that records the exact version of every package your project installed, including the packages your packages depend on.
Quotable facts
As of 2026-10-07
- Crowsnest reads package-lock.json, pnpm-lock.yaml, yarn.lock, poetry.lock, Cargo.lock and go.sum (lockfile reader, 2026-10-07).
- A scan reads the lockfile in the folder you give it (scan, 2026-10-07).
- npm projects get the most checks (README and lockfile reader, 2026-10-07).
Why does it matter?
It is the list Crowsnest reads. It makes installs repeatable, and it shows you what changed between two reviews.
How do I stay safe?
- Commit your lockfile to version control.
- Look at lockfile changes in code review, not only code changes.
- Install from the lockfile in your builds.
What this does not do
A lockfile does not say whether a package is safe. It only records what you have. Crowsnest scans that record; it cannot check a folder with no lockfile.
Where do I read more?
Related terms: supply chain attack and maintainer takeover. Read How to stay safe from malicious packages, or learn how to scan a project in CLI usage. Back to the glossary.
Related
- Supply chain attackA supply chain attack is when an attacker harms you by tampering with something you rely on, such as a software package, instead of attacking you directly.
- Maintainer takeoverA maintainer takeover is when control of a package passes to a new, often unvetted account, which then changes what the package does in a later release.
- How to stay safe from malicious packages.Five habits that take under a minute each.
- CLI usageUse the crowsnest command to scan a project, check one package and stop risky installs at risk 0.6. Commands, options and exit codes for your terminal.