[Groxx]

This is essentially what shrinkwrap does. Apparently it has issues, but it's designed to be the lock file for your package.json.