lintlock

lintlock

CLI for linting npm ecosystem lockfiles for security and consistency issues.

A standalone CLI wrapper around eslint-plugin-lockfile that works without any ESLint configuration.

Installation

npm install -g lintlock

Or use with npx:

npx lintlock

Usage

lintlock [options] [lockfile-path]

If no lockfile path is provided, searches the current directory for lockfiles.

Options

Option	Alias	Description
--flavor <pm>	-f	Allowed package manager(s): npm, yarn, pnpm, bun, vlt. Can be specified multiple times. Defaults to auto-detect.
--registry <url>	-r	Allowed registry URL(s). Can be specified multiple times. Defaults to npm config.
--algorithms <alg>	-a	Allowed integrity hash algorithm(s): sha1, sha256, sha384, sha512. Can be specified multiple times. Defaults to all.
--help		Show help message

Examples

Basic Usage

Lint lockfile in current directory:

lintlock

Lint a specific lockfile:

lintlock package-lock.json
lintlock /path/to/project/yarn.lock

Restrict Package Managers

Allow only npm lockfiles:

lintlock -f npm

Allow npm or yarn:

lintlock -f npm -f yarn

Restrict Registries

Require packages from the official npm registry:

lintlock -r https://registry.npmjs.org/

Allow multiple registries:

lintlock -r https://registry.npmjs.org/ -r https://npm.pkg.github.com/

Restrict Integrity Algorithms

Require SHA-512 integrity hashes:

lintlock -a sha512

Allow SHA-512 or SHA-384:

lintlock -a sha512 -a sha384

Combined Options

lintlock -f npm -r https://registry.npmjs.org/ -a sha512 package-lock.json

Exit Codes

Code	Description
0	No errors found (warnings are OK)
1	Errors found or execution failed

Supported Lockfiles

Package Manager	Lockfile(s)
npm	package-lock.json, npm-shrinkwrap.json
yarn	yarn.lock
pnpm	pnpm-lock.yaml
bun	bun.lock, bun.lockb
vlt	vlt-lock.json

Rules

The CLI runs the following checks from eslint-plugin-lockfile:

• flavor - Ensures only allowed lockfile formats are present
• version - Validates lockfile version
• integrity - Verifies all packages have valid integrity hashes
• registry - Ensures packages come from allowed registries
• non-registry-specifiers - Warns on non-registry dependencies (GitHub, git, file paths)
• binary-conflicts - Detects binary name conflicts between packages

Programmatic Usage

import { lintLockfile } from 'lintlock';

const exitCode = await lintLockfile('/path/to/package-lock.json', {
	flavor: ['npm'],
	registry: ['https://registry.npmjs.org/'],
	algorithms: ['sha512'],
});

process.exit(exitCode);

Related

• eslint-plugin-lockfile - ESLint plugin with configurable rules
• lockfile-tools - Utilities for parsing lockfiles

Tests

Clone the repo, npm install, and run npm test.

License

MIT