npm-lock - Security policy project