@yarnpkg/lockfile

The parser/stringifier for Yarn lockfiles.

Supply chain provenance

Status for the latest visible version.

Without SLSA provenance there is no cryptographic link between this tarball and the public source, so a manually published version cannot be tied back to a reviewed commit.

Maintainers

Keywords

Accepted risks

Findings the reviewer chose to accept rather than block on.

Source	Rule	Reason	Accepted by	When
semgrep	semgrep:etc-passwd-access	AI (semgrep): The flagged line is a code comment ('// Test: ./node test/fixtures/echo.js < /etc/passwd'), not actual /etc/passwd access. Stable false positive for this package.	ai	2026/04/24
provenance	publisher-changed	AI (provenance): Publisher change from daniel15 to arcanis in 2018 reflects the documented Yarn project maintainer transition; arcanis is the primary Yarn creator with a strong track record.	ai	2026/04/24
maintainer-change	maintainer-added	AI (maintainer-change): New maintainers (arcanis, bestander, cpojer, sebmck) are well-known Yarn/JS ecosystem contributors; this was a legitimate team consolidation in 2018.	ai	2026/04/24
semgrep	semgrep:base64-decode	AI (semgrep): Base64/hex conversion is used for integrity hash handling in a lockfile parser — legitimate and expected behavior, not a malicious payload.	ai	2026/04/23
bogus-package	bogus-package	AI (bogus-package): sebmck and cpojer are well-known legitimate JS ecosystem contributors (Babel creator, Meta engineer); spam flag is a false positive for this package.	ai	2026/04/23
semgrep	semgrep:hex-decode	AI (semgrep): Hex-to-base64 conversion for integrity hash normalization; standard lockfile parser functionality, not obfuscation.	ai	2026/04/23
semgrep	semgrep:env-bulk-read	AI (semgrep): Bundled debug library reads DEBUG_* env vars for logging configuration — well-known benign pattern stable across versions.	ai	2026/04/23

Version	Deps	Published
1.1.0	0 / 0	2018-09-10
1.0.2	0 / 0	2018-06-11
1.0.1	0 / 0	2018-05-11
1.0.0	0 / 0	2017-08-22