Public search query: npm supply chain: how to audit your lockfile