I've noticed on Travis that if a project is testing on Node.js 8 then NPM will automatically create the 'package-lock.json' file, but it's best not to use this file yet. See 10ec7f0576
10ec7f0576