Why is NPM Fetching a Dependency Not in My package-lock.json?

npm can fetch dependencies missing from package-lock.json when packages come from GitHub repos, relative paths, or carry peer dependencies; the post explains why and how to manage it safely.