The lockfile mitigates supply chain attacks to a large extent. Much like any other language’s package ecosystem.