🔧 When ‘Are We Affected?’ Requires Reconstructing Yesterday’s npm Install

The concrete problem


A package is reported compromised. Your security channel immediately fills with one question: did we ship it?

Looking at the repository’s current dependency tree is not enough. The vulnerable version may have existed for only a short time. Renovate may already have replaced it. A lockfile may have changed after the release....