[NoahKAndrews]

npm install updates the lock file when you have changed a dependency in package.json, which is reasonable behavior.

[Aeolun]

It’s not if you want your install command to be deterministic.

I never want the install command to change anything. I want it to install only.