Pin dependency versions

[AlMcKinlay]

I'd like to pin all our dependency versions. The pad-left debacle has confirmed something to me:

09:31 &YaManicKill Yeah, it might be fine because we don't use pinned versions (but...we probably should, now that I've thought about some things today)
09:31 &YaManicKill Because technically, someone can unpublish something, someone else can then take that name and publish new code with a patch version number update, and include malicious code.

[AlMcKinlay]

#!/usr/bin/env bash
curl https://gist.githubusercontent.com/azer/db27417ee84b5f34a6ea/raw/50ab7ef26dbde2d4ea52318a3590af78b2a21162/gistfile1.txt \
    | sed 's/^\(.*\)$/\/\1$/' \
    > ~/suspicious-packages.txt \
    && npm ls --parseable \
    | grep -f ~/suspicious-packages.txt

That can be run to find out if any of our packages were one of the ones pulled btw, and then we can check we won't download a new "malicious" version of it.