package lock json peer flag