I'm not super familiar with npm, but I do know that

package-lock.json

is being used