I still don't see how lockfiles can't be SBOM.

They contain for each dependency name, version, (derivable) URL and integrity checksum, plus of course the intra-dependency relationships.

This can all be verified at any point in the lifecycle without running any of the code, provided a network connection and/or the module cache. What's missing?

> With authenticode, the "catalog" can be signed

You could trivially sign any lockfile, though I've never seen it. I think it could be neat and it might have a chance to catch on if there was more support in tooling for it. The NPM registry does support ECDSA package sigs but I guess signatures for this use should be distributed on other channels given how much of an antipattern uploading lockfiles to registry is considered in the npm community and that's an uphill. In the context of SBOMs I guess there's already a slot for it?