Bug with package-lock.json?