npm package lock json dev true