open-coder-ai/lockfile-integrity
v0.0.3Apache-2.0
Script gate (commit, agent write, CI) over npm, yarn, pnpm, bun, poetry, uv, Pipfile, Cargo, go.sum, Gemfile, composer and NuGet locks. Blocks: source off the registry list or not https, missing hash, hash changed for a locked version, unpinned git source, unreadable lock. Asks: SHA-1-only hash, transitive install script, lock or manifest moved alone, go.sum lines removed, lock ignored or deleted. Judges what a change adds. Friction, not a security boundary.
open-coder-ai publishes lockfile-integrity in 3 places.
open-coder-ai/chock-claude-plugins
open-coder-ai/chock-copilot-plugins