Ensure integrity checksums exist in lockfile for all npm packages

[patcon]

npm packages have a content-specific "integrity" hash for all their contained files. This comes from the npmjs repository, and so if any files are different from what was in the package, then npm can notice. These integrity hashes are stored in package-lock.json.
https://docs.npmjs.com/cli/v6/configuring-npm/package-lock-json#integrity

Sometimes these are missing, and we should know when that happens.

This may involve:

• a GitHub Action or npm package that checks for missing integrity hashes in package-lock.json during CI, or
• some flag in npm that enforces strictness (??), or
• all of the above, for added confidence

Related issue: npm/cli#4460

Related: No pressure to pollute our labels, but do you think it's worth having a security label to make security tasks more visible, @tristan-orourke?

To Do

• research npm packages that validate integrity
• research npm flags that force this
• optional: add security label
• maybe: create/modify github action to do this
• confirm integrity hashes are present Add package integrity check #2414
• confirm integrity hashes are well-formed Add package integrity check #2414
• validate hashes match local content. Check that integrity hashes match files on system #2557
  • confirm integrity hashes match cached tarball. see: https://gist.github.com/patcon/88e7e8332e49abd06b79feb1d0a134bd
• validate hashes match npmjs hashes. Check that integrity hashes match hashes from NPM #2558

[tristan-orourke]

do you think it's worth having a security label to make security tasks more visible

For sure @patcon, added the label!

[patcon]

Not sure how we want to handle this. Technically, this could be a collector issue for the remaining steps, but I understand if people want the endorphin rush of closing it, and we can treat those new tickets as standalone :)

[patcon]

Wondering if maybe this is helpful to show what we're trying to cover, that for some reason it seems npm cli is not doing for us right now: (we assume NPM website is trusted)

Item	NPM	<=>	local cache	<=>	project folder
hash	✅	❓	~/.npm/foo/x.y.z/package/package.json	❓	package-lock.json
content	✅	❓	~/.npm/foo/x.y.z/package.tgz	❓	node_modules/foo