I can also recommend using NSP [0] to check your .lock files for security issues, for what it's worth.

[0] https://disjoint.ca/til/2017/11/10/managing-package-dependen...