I don't really. If you only wanted to control your first-level dependencies, you would simply not use caret and tilde ranges in your package.json, no lockfile needed (except for cryptographic verification).