The final build would probably have failed (on a build server using CI). But when developing locally I think package.json wins over the lock file (? at least of

The final build would probably have failed (on a build server using CI). But when developing locally I think package.json wins over the lock file (? at least often the lockfile is updated after doing an npm install here). So this probably wouldn't show up on the final build distributed and deployed somewhere. But it did manage to run arbitrary code on developers' machines of those companies.