kopach/lockfix

GitHub: kopach/lockfix

Stars: 25 | Forks: 3

[![#StandWithUkraine](https://static.pigsec.cn/wp-content/uploads/repos/2026/05/c2aa141eb1094752.svg)](https://github.com/vshymanskyy/StandWithUkraine#readme)


  _               _    _____ _      

 | |    ___   ___| | _|  ___(_)_  __

 | |   / _ \ / __| |/ / |_  | \ \/ /

 | |__| (_) | (__|   <|  _| | |>  < 

 |_____\___/ \___|_|\_\_|   |_/_/\_\

[lockfix](https://github.com/kopach/lockfix)

[![Snyk Vulnerabilities badge](https://snyk.io/test/github/kopach/lockfix/badge.svg)](https://snyk.io/test/github/kopach/lockfix) [![Maintainability](https://api.codeclimate.com/v1/badges/f7e2f85327eeb6b52439/maintainability)](https://codeclimate.com/github/kopach/lockfix/maintainability) [![Language grade: JavaScript](https://img.shields.io/lgtm/grade/javascript/g/kopach/lockfix.svg?logo=lgtm&logoWidth=18)](https://lgtm.com/projects/g/kopach/lockfix/context:javascript) [![NPM badge](https://nodei.co/npm/lockfix.png?compact=true)](https://www.npmjs.com/package/lockfix)

[lockfix](https://github.com/kopach/lockfix) – is a [git](https://git-scm.com/) based CLI tool, which helps to revert `sha1` integrity changes of npm lock file

Before ![screenshot before](https://static.pigsec.cn/wp-content/uploads/repos/2026/05/7a3a5712b8094753.png) After ![screenshot after](https://static.pigsec.cn/wp-content/uploads/repos/2026/05/5a838559d3094754.png)

## 🧬 Table of Contents - [❓ Why?](#-why-) - [✨ Features](#-features-) - [💾 Install](#-install-) - [🔨 Usage](#-usage-) - [📄 License](#-license-) ## ❓ Why? [🔝](#-table-of-contents) [NPM](https://npmjs.org/) has known issue of constantly changing `integrity` property of its lock file. Integrity may change due to plenty of reasons. Some of them are: - `npm install` done on machine with different OS from one where lock file generated - some package version updated - another version of `npm` used Intention of this tool is to prevent such changes and make `integrity` property secure and reliable. ## ✨ Features [🔝](#-table-of-contents) - Reverts changes from `sha512` to `sha1`. Keeps untouched changes from `sha1` to `sha512`. `sha512` algorithm is more secure. - Works well with both `package-lock.json` and `npm-shrinkwrap.json` - Possibility to revert any changes done by **this tool** ## 💾 Install [🔝](#-table-of-contents) Install per project with [NPM](https://npmjs.org/) npm install --save-dev lockfix or to install globally npm install -g lockfix ## 🔨 Usage [🔝](#-table-of-contents) ### Add to `package.json` "scripts": { "postshrinkwrap": "lockfix", }, ### Manually from terminal lockfix or (without install) npx lockfix #### Options Usage: lockfix [options] Options: -V, --version output the version number -c, --commit make backup commit with revert instruction before applying changes -f, --force bypass Git root directory check -q, --quiet suppress output -h, --help display help for command ## 📄 License [🔝](#-table-of-contents) This software licensed under the [MIT](https://github.com/kopach/lockfix/blob/master/LICENSE)

标签：自动化攻击