Now that npm v5.0.0 is out, using npm packages auto-generates a package-lock.json on npm install. In my