Developers are often getting unexpected changes in their package-lock.json when running npm install in their project. This is most of the time caused by developers using different major versions of npm.
To avoid this as much as possible, we should probably enforce the update of npm to the lastest version during the provisioning.