I'm not fully clear what you mean by don't delete lock file when the problem is the open source developer decides to unpublish their npm package