pin-node-dependencieslisted

# Skill: pin-node-dependencies Audits a Node.js / JS / TS repository and verifies that **every dependency in every `package.json` is pinned to an exact version**. Version ranges (`^1.2.3`, `~1.2.3`, `>=1`, `*`, `1.x`), floating dist-tags (`latest`, `next`), and mutable git refs (`#main`) mean `npm install` can silently pull a *different* build than the one that was reviewed and tested — the delivery vector behind worm-style npm supply-chain attacks. Exact pinning + a committed lockfile makes installs reproducible and shrinks the window for a malicious republish to slip in. Run this when asked to "check if dependencies are pinned", harden the npm supply chain, or as the Node slice of a release/supply-chain audit (see the sibling skill **`release-audit`**). Pairs with **`pin-github-actions`** for the CI side. ## Pinning rule A spec is **pinned** only when it resolves to one immutable artifact: | Spec | Verdict | |---|---| | `1.2.3`, `1.2.3-beta.1` (exact semver) | ✅ pinned | | `npm:pkg@1.2.3` (exact alias) | ✅ pinned | | `git+https://…#<40-hex-sha>` (commit-pinned git dep) | ✅ pinned | | `https://…/pkg-1.2.3.tgz` (exact tarball) | ✅ pinned | | `workspace:*` / `workspace:^` (workspace protocol, monorepo) | ✅ N/A — resolved locally at publish | | `file:`, `link:`, `portal:` (local) | ✅ N/A | | `^1.2.3`, `~1.2.3`, `>=1`, `<2`, `1.2.x`, `*`, `1 \|\| 2` | ❌ range | | `latest`, `next`, any dist-tag | ❌ floating | | `git+https://…#main` / `#master` / branch/tag | ❌ mutable ref |