A README may claim the project pins secure versions. The lockfile shows whether that claim survived the last merge conflict.
During dependency reviews we treat lockfiles as primary evidence: version pins, transitive depth, and scripts that run at install time. Surprises often hide in packages nobody on the team remembers adding.
We also ask how private packages enter the build. A mirrored registry in Changhua with incomplete integrity checks can undo careful public-package hygiene.
If you prepare for an audit, export the lockfiles your CI actually consumes — not a cleaned laptop checkout that diverges from the pipeline.