npm/shallow-package-lock