@jni @brettcannon That's what I thought as well. I guess the final responsibility if for the end user to make sure their packages are sound, and a lockfile would help there. Though perhaps we library maintainers can play a role by using a lockfile only for CI, and update it regularly to spot upstream compromised packages? Preferably in an automated way?