[BUG]: Lockfile Bypass in Release Script Exposes Publisher to Supply Chain Attacks

# Location
renderers/web_core/package.json:62

# Description
The publish:package script in package.json intentionally bypasses the repository's dependency lockfile by executing touch yarn.lock && yarn install in the dist directory prior to publishing. Creating an empty yarn.lock forces the package manager to dynamically resolve the latest matching versions for all dependencies (and their transitive dependencies) from the public NPM registry, completely ignoring the stable, pinned versions in the project's root lockfile. This exposes the publisher's machine to a direct supply chain attack: if a malicious update to a transitive dependency is published just before a release, yarn install will fetch it and execute its postinstall scripts with the publisher's credentials, potentially leading to compromise of the publisher's machine or unauthorized modification of the released package.

# Impact
Publisher machine compromise, potential leakage of NPM publish tokens, and the potential release of an untested or compromised package bundle.

# Mitigation
Remove touch yarn.lock && yarn install from the publish script. If dependencies must be installed in dist/ before publishing, copy the repository's root yarn.lock into dist/ first to ensure the dependency tree remains strictly pinned. Update the script to use cp ../yarn.lock dist/ and run yarn install --frozen-lockfile (or equivalent) instead.

# Reproduction Steps
Open renderers/web_core/package.json.
Locate the publish:package script.
Note the command sequence: cd dist && touch yarn.lock && yarn install.
Observe that this forcefully discards the repository's existing lockfile, making the publish step vulnerable to resolving fresh (and potentially malicious) transitive dependency updates.

# Evidence
"publish:package": "yarn build && node ../scripts/prepare-publish.mjs && cd dist && touch yarn.lock && yarn install && yarn npm publish --access public"

# Reasoning
The publish:package script explicitly executes touch yarn.lock && yarn install in the dist directory. Creating an empty yarn.lock forces Yarn to ignore any previously pinned versions from the repository's root lockfile and dynamically resolve the latest matching dependency versions from the registry. This exposes the CI environment or publisher's machine to supply-chain attacks: if a malicious update is published to a transitive dependency, the unpinned yarn install will fetch and execute it (e.g., via lifecycle scripts) with the publisher's credentials.

To verify:

Examine the publish:package command in renderers/web_core/package.json.
In a test environment, create a root yarn.lock that pins a specific older version of a dependency.
Publish a newer version of that dependency to a local registry with a postinstall script that executes an observable action (e.g., writing a file).
Run the publish sequence: cd dist && touch yarn.lock && yarn install.
Observe that the newer version is fetched and the postinstall script executes, demonstrating that the root lockfile was bypassed and unpinned dependencies were installed.

The issue is in renderers/web_core/package.json at line 62 in the 'publish:package' script. Examine the script to understand the current flow. The fix involves modifying the script to copy the root yarn.lock into the dist directory and using yarn install with the --frozen-lockfile flag. Test by running the publish script in a safe environment to ensure dependencies are now pinned.

Escrito por el modelo de indexación a partir del texto del issue.