Support for package-lock.json

[logan064]

Does this project support a package-lock.json? I noticed that some of the transitive dependencies changed overtime and I was hoping the executable would spit out a package-lock.json so I could use it to reliably create the same tar ball each time. I searched the repo, but did not find any reference to package-lock.json.