Comment Comment by technics256 Can't there be a "package signature" of some sort that is specified and checked against in a package-lock.json or yarn.lock? parent technics256 5 years ago
