---
title: "Lockfile integrity and install scripts"
description: "Checks npm, pnpm, Bun and Yarn lockfiles offline, in the spirit of lockfile-lint: packages resolved over plain HTTP, from unexpected or repository-configured registries, git or local paths outside the repository, entries without (or with SHA-1-only) integrity hashes, dependencies that run install scripts without an allow-list, and lockfiles out of date with package.json. Also flags insecure registries and pip/Composer index settings."
url: https://openaudit.se/auditors/code.lockfiles/
---

# Lockfile integrity and install scripts

`code.lockfiles`

Checks npm, pnpm, Bun and Yarn lockfiles offline, in the spirit of lockfile-lint: packages resolved over plain HTTP, from unexpected or repository-configured registries, git or local paths outside the repository, entries without (or with SHA-1-only) integrity hashes, dependencies that run install scripts without an allow-list, and lockfiles out of date with package.json. Also flags insecure registries and pip/Composer index settings.

- **Engine:** Built-in
- **Targets:** Codebase
- **Areas:** Supply chain
- **Runs:** By default, when the target applies
- **Network:** Only the target itself

## Run only this auditor

```sh
bunx @openaudit/cli . --only code.lockfiles
```

Built into openaudit; nothing to install.

## More supply chain auditors

- [Vulnerable dependencies](https://openaudit.se/auditors/code.dependencies/) (`code.dependencies`)
- [Dependency health](https://openaudit.se/auditors/code.dependency-health/) (`code.dependency-health`)
- [osv-scanner dependency scan](https://openaudit.se/auditors/code.osv-scanner/) (`code.osv-scanner`)
- [govulncheck (Go vulnerabilities)](https://openaudit.se/auditors/code.govulncheck/) (`code.govulncheck`)
- [pip-audit (Python vulnerabilities)](https://openaudit.se/auditors/code.pip-audit/) (`code.pip-audit`)
- [cargo-audit (Rust advisories)](https://openaudit.se/auditors/code.cargo-audit/) (`code.cargo-audit`)
- [npm audit](https://openaudit.se/auditors/code.npm-audit/) (`code.npm-audit`)
- [pnpm audit](https://openaudit.se/auditors/code.pnpm-audit/) (`code.pnpm-audit`)