Why NPM lockfiles can be a security blindspot for injecting malicious modules | Heykuki News