package.json and package-lock.json

Let's decode the reason for package.json and package-lock.json