[Feature Require]: whitelist for npm registry in package-lock.json

[axetroy]

When our project depends a lot, package-lock.json will become very large.

This will cause a lot of changes in package-lock.json when adding a new dependency.

This makes it difficult for us to review package-lock.json

Let's Imagine:

We currently using https://registry.npmjs.org in package-lock.json

Now, a new contributor initiate a PR and update package-lock.json, and it quietly changed one of its dependent's registry to https://unknown.registry.com. This domain name is a domain name prepared by the hacker. It has altered the dependent's postinstall hook. When npm downloads this dependency, it can execute the hook function postinstall.This is a disaster for anyone.

So we need a whitelist mechanism to download only trusted registries.

[travi]

some prior art to consider here is https://github.com/lirantal/lockfile-lint by @lirantal. i've been using this in a lot of my projects specifically for this reason.

[axetroy]

some prior art to consider here is https://github.com/lirantal/lockfile-lint by @lirantal. i've been using this in a lot of my projects specifically for this reason.

LGTM, after all, this is a third-party tool, it would be better if npm provided such a feature

[travi]

very much agree that it would be great to be a core feature. just highlighting as a reference if it gets that far. hopefully also helps in the meantime for folks looking for protection now