I'm well aware of package locks. However npm has a horrible implementation of package locking. Running npm install will regenerate your package lock unless you removed prefixs from all your packages or you install using --package-lock-only[1].

So my question to you is, have you been using npm package locks correctly? Or do you let npm install generate a new package lock every time its run?

[1]: https://stackoverflow.com/questions/45022048/why-does-npm-in...