I'm trying to figure out whether node2nix [0] could help avoid package name/version hijacking vulnerabilities. Node2nix can convert a package-lock.json file to

I'm trying to figure out whether node2nix [0] could help avoid package name/version hijacking vulnerabilities. Node2nix can convert a package-lock.json file to something called a Nix expression [1], like this [2], where each dependency has a checksum. The purpose is to make the Nix expression deterministic so that each Nix package is reproducible. [0] https://github.com/svanderburg/node2nix https://github.com/svanderburg/node2nix [1] https://nixos.org/nix/about.html https://nixos.org/nix/about.html [2] https://github.com/svanderburg/node2nix/blob/22d0c19575ecd19208cbdfbb54e8c2228c553bf7/node-packages.nix#L13 https://github.com/svanderburg/node2nix/blob/22d0c19575ecd19... Edit: fix link formatting