package-lock.json coverage