package lock json peer