npm install using package lock json