> NPM by default generates a package-lock.json file

Thanks for the tidbit, seen it been added May last year to npm5[0]. Hard to keep up if you don't use the tooling activity and only depend on it for other tooling.

[0]: http://blog.npmjs.org/post/161081169345/v500