package lock json github