Comment by riquito

Lockfiles protect you from someone who would publish a malware that replaces an existing version (lockfiles have hashes alongside the versions)