You are right... It's really stupid that they recreate the `package-lock.json`, the package-lock feature is really not at all working like user expect it to. It's 100% bullshit marketing from NPM : "Look we are doing lockfiles just like yarn".