Lockfile Poisoning is an attack technique using which a developer with malicious intent can introduce malware in a project’s source code in a way which is almost invisible to code reviewers. This is an especially challenging and risky problem for open source projects where a contributor can sneak in malware by exploiting the cognitive load involved in reviewing changes in auto-generated lockfiles such as package-lock.json which many a times are hidden by default by Github and Gitlab.