Even if you have `package-lock.json`, if there's new patch version of packages that still satisfy the version spec. NPM will install new version of that package

Even if you have `package-lock.json`, if there's new patch version of packages that still satisfy the version spec. NPM will install new version of that package on your machine and silently update your package-lock.json file. Until recently, they don't follow immutable versioning. Publisher can remove package at will. The NPM team looks like they ignore any knowledge any existing package manager before them ever did. They just happen to get included by NodeJS and become defacto by convenience.