In 2016, Facebook announced the open-source release of Yarn: an alternative client for the npm registry. While it’s true that Yarn is often much faster than other clients, and that the new lockfile ensures more consistency when your application is installed, the security claims around it are a little over-optimistic.