diff --git a/workspaces/arborist/test/fixtures/tap-with-yarn-lock/node_modules/lcov-parse/.snyk b/workspaces/arborist/test/fixtures/tap-with-yarn-lock/node_modules/lcov-parse/.snyk
new file mode 100644
index 0000000000000..b12fb8a2831bd
--- /dev/null
+++ b/workspaces/arborist/test/fixtures/tap-with-yarn-lock/node_modules/lcov-parse/.snyk
@@ -0,0 +1,10 @@
+# Snyk (https://snyk.io) policy file, patches or ignores known vulnerabilities.
+version: v1.25.1
+ignore: {}
+# patches apply the minimum changes required to fix a vulnerability
+patch:
+  'npm:uglify-js:20151024':
+    - istanbul > handlebars > uglify-js:
+        patched: '2024-10-22T16:38:20.789Z'
+        id: 'npm:uglify-js:20151024'
+        path: istanbul > handlebars > uglify-js
diff --git a/workspaces/arborist/test/fixtures/tap-with-yarn-lock/node_modules/lcov-parse/package.json b/workspaces/arborist/test/fixtures/tap-with-yarn-lock/node_modules/lcov-parse/package.json
index cd3c9fdc62def..af2f9658b4c32 100644
--- a/workspaces/arborist/test/fixtures/tap-with-yarn-lock/node_modules/lcov-parse/package.json
+++ b/workspaces/arborist/test/fixtures/tap-with-yarn-lock/node_modules/lcov-parse/package.json
@@ -18,18 +18,24 @@
     "parser"
   ],
   "devDependencies": {
-    "istanbul": "^0.2.10",
+    "istanbul": "^0.4.5",
     "jshint": "^2.5.1",
     "vows": "*",
-    "yui-lint": "~0.1.1"
+    "yui-lint": "~0.2.0"
   },
   "scripts": {
     "pretest": "jshint --config ./node_modules/yui-lint/jshint.json ./lib/",
-    "test": "istanbul cover --print both ./node_modules/vows/bin/vows -- --spec ./tests/*.js"
+    "test": "istanbul cover --print both ./node_modules/vows/bin/vows -- --spec ./tests/*.js",
+    "prepublish": "npm run snyk-protect",
+    "snyk-protect": "snyk-protect"
   },
   "license": "BSD-3-Clause",
   "repository": {
     "type": "git",
     "url": "http://github.com/davglass/lcov-parse.git"
+  },
+  "snyk": true,
+  "dependencies": {
+    "@snyk/protect": "latest"
   }
 }