package.json ships "nan": "^2.23.1". NAN is compiled into the addon (binding.gyp require('nan')). A caret is not a pin: every consumer npm install re-resolves >=2.23.1 <3.0.0. This repo's lockfile hashing 2.28.0 does not bind dependents.
Pin nan to the reviewed exact version (currently 2.28.0). Prefer a shrinkwrap (or equivalent dependents actually apply) with integrity hashes. CI should install from the lockfile (npm ci), not a floating npm install.
package.jsonships"nan": "^2.23.1". NAN is compiled into the addon (binding.gyprequire('nan')). A caret is not a pin: every consumernpm installre-resolves>=2.23.1 <3.0.0. This repo's lockfile hashing2.28.0does not bind dependents.Pin
nanto the reviewed exact version (currently2.28.0). Prefer a shrinkwrap (or equivalent dependents actually apply) with integrity hashes. CI should install from the lockfile (npm ci), not a floatingnpm install.