Manually auditing an update of potentially hundreds of packages when package-lock.json gets regenerated is so challenging that many projects won't do it — and f

Manually auditing an update of potentially hundreds of packages when package-lock.json gets regenerated is so challenging that many projects won't do it — and for those projects, the cryptographic hashes offer limited value. To make industry-wide improvements, we need to share resources for auditing of packages. There are many such endeavors underway at various stages of maturity. But this feature doesn't move that ball forwards. From the comments: https://github.com/nodejs/node/pull/36328#issuecomment-736034792 https://github.com/nodejs/node/pull/36328#issuecomment-73603... > It is insecure because there is no signature of the original file. Anybody that can take control of a domain name can take control of a server. Downloaded arbitrary code can't be added to a pool of pre-validated packages, except insofar as you control the server and only make pre-validated packages available on it exclusively to your own services.