Javascript

npm allows specifying packages by URL in many different ways:

// URL directly to a tarball. No version specified
    "asd": "http://asdf.com/asdf.tar.gz",
// `git+ssh` URL with a commit-ish
    "cli": "git+ssh://[email protected]:npm/cli.git#v1.0.27",
// `git` protocol URL with a `semver` version range
    "example": "git://github.com:npm/example#semver:^5.0",
// GitHub reference with a commit-ish
    "module": "user/repo#feature\/branch"

I would hope that the git URLs are locked to a specific commit hash before they are put into the package-lock.json, but I haven't yet tested this.

For the direct tarball URL, I would hope that a hash is included in the package-lock.json file.

It's worth pointing out that the last one doesn't even include a URL, but it is just a short for of referencing a project on github.com

from phylum-types.