title: Why does package-lock.json have different listed dependencies to package.json?
body: <p>I installed eslint and noticed that it initialized a package-lock.json file and installed a bunch of modules in my node_module folder that I didn't request. I'm not sure why.</p>
  <p>More importantly, theres discrepancies between my package.json and package-lock.json listed dependencies. My understanding was that package.json listed my installed dependencies with their semver and package-lock ensured that the exact version i was using is also used by anyone else installing the modules.</p>
  <p>So my questions are:</p>
  <ol>
  <li>Why are there discrepancies ad shouldn't they have mirror listed dependecies?</li>
  <li>Which .json will install dependencies upon request and why?</li>
  <li>Why were these installed in the first place from eslint?</li>
  </ol>
  <p>Thanks</p>