One compromised package. How far does it fall?

Import a package-lock.json to see how far a hypothetical compromise of one package could spread.

Uploaded lockfiles stay in browser memory. Nothing is stored, and the app never installs or executes package code.