Why is NPM Fetching a Dependency Not in My package-lock.json?

This document explains why npm may fetch dependencies that are not present in your `package-lock.json`, covering causes such as dependencies pulled from GitHub (which may require building and thus pull devDependencies), local file path dependencies, and peer dependencies. It provides mitigation steps including reviewing `package.json`, running `npm audit`, keeping dependencies updated, and using `npm ls` to trace dependency origins.