---
id: 1948
title: "Why is NPM Fetching a Dependency Not in My package-lock.json?"
source_domain: hackerone.com
source_url: "https://www.hackerone.com/blog/why-npm-fetching-dependency-not-my-package-lockjson"
published_at: "2024-01-25T06:59:51Z"
tags: ["supply-chain", "npm", "package-management", "nodejs", "dependencies"]
phying_url: "https://phying.com/item/1948"
lang: en
---

# Why is NPM Fetching a Dependency Not in My package-lock.json?

## Summary

npm can fetch dependencies missing from package-lock.json when packages come from GitHub repos, relative paths, or carry peer dependencies; the post explains why and how to manage it safely.

## Intelligence Metadata

- **Sources:** hackerone.com
- **Published:** 2024-01-25T06:59:51Z
- **Original:** https://www.hackerone.com/blog/why-npm-fetching-dependency-not-my-package-lockjson
- **Phying News:** https://phying.com/item/1948