Do you review changes in auto-generated lock files such as package-lock.json? If not, attackers might be exploiting the cognitive load of reviewing auto-generated changes to introduce malware in code