Yes, shrinkwrapp is a good solution to lock down your dependency versions. Regarding the security breaches, this is a big problem because, as you mention, there

Yes, shrinkwrapp is a good solution to lock down your dependency versions. Regarding the security breaches, this is a big problem because, as you mention, there are huge chains of dependencies, and also some of the vulnerabilities are not even in your direct dependency - which makes it hard to fix vulnerabilities. Snyk recently released stats that found that 14% of npm packages carry known vulnerabilities. Also 64% of our users have found a vulnerability in a private repo, so the chance that your package also contains a vulnerable dependency is quite high.(I work there btw) We released an open source cli tool that helps you find and fix vulnerabilities in your dependencies tree. You are welcome to try it - https://snyk.io https://snyk.io. You can also take a look at our open source vulnerabilities database with advisories and patches at https://github.com/Snyk/vulndb https://github.com/Snyk/vulndb.