package.json should use fixed versions.

https://github.com/ethereum/solc-js/blob/ee8632967bf1a51602753e113897466e6874be7e/package.json#L47-L57

To protect users against supply chain attacks, package.json should refer to explicit versions and version updates should be done intentionally rather than "when CI happens to build" or "when user happens to install the dependency".

It is worth noting that this does *not* protect users against transitive dependencies of this library, unless each of the dependencies *also* uses explicit versions in `package.json`. To more thoroughly protect users against supply chain attacks, only dependencies that also use explicit dependency versions should be used and the same for their dependencies etc.

---

Separately, I think it is worth discussing the use of `npm shrinkwrap`. This would make it so the developers of this library can do a one-time audit of their dependency tree and then commit and publish that so downstream users don't have to each do a full audit of `solcjs`'s transitive dependencies every time they update or install it.

Start with package.json lines 47-57 and review the comment thread to identify the dependencies that should use explicit versions. Then assess the separately proposed npm shrinkwrap; done means the requested dependency versions are fixed and the shrinkwrap decision is addressed.

Written by the indexing model from the issue text.