Vaadin 24.8.3, how can we make sure it does not contains hijacked packages?

Nothing will actually be installed from that npm install if you haven’t changed pom.xml or package.json as long you have a previous package-lock.json file in place. This means that you would be safe in most cases but not e.g. if starting a new project or doing some affected version update during that time window.

1 Like