Another way to mitigate this attack is to only let trusted sources update the
package-lock.json (👋 @greenkeeperio).
https://snyk.io/blog/why-npm-lockfiles-can-be-a-security-blindspot-for-injecting-malicious-modules/