Dependencies in almost any software system are fundamentally built on trust. You trust that minor version upgrades won't break the system, or that malicious co

Dependencies in almost any software system are fundamentally built on trust. You trust that minor version upgrades won't break the system, or that malicious code won't be introduced. But we're human... things break. This can happen in any ecosystem, but npm is particularly vulnerable because of it's huge dependency trees. Which is only possible due to the low overhead of creating, including and resolving packages. That's why npm has the "package-lock" file, which takes a snapshot of the entire dependency tree, allowing a truly reproducible build. Not using this is a risk.