I don't usually comment on HN, but I feel inclined for this article. The advice here is very poor and misleading and shows that the author has a weak understand

I don't usually comment on HN, but I feel inclined for this article. The advice here is very poor and misleading and shows that the author has a weak understanding of the ecosystem. Their suggestion is to lock your project dependencies in your package.json file, however this completely ignores the rest of the dependency graph that is brought in as a result of installing those packages, locked or not. In my experience almost every CVE or exploited package was a dependency of a dependency of a dependency that I have no direct control over. The only way to ensure dependencies of dependencies aren't changing without your knowledge is to use and commit a lock file.