Supply Chain Security: How to Verify Past Builds for Vulnerable npm Packages?
When a new software vulnerability is found, it's surprisingly hard to tell if your past product releases ever included the compromised package. Answering 'Were we affected?' requires reconstructing precisely what was installed during each specific build, as current dependencies often don't tell the whole story.
