npm package lock json peer true