My 2 cents worth.
@Jalibu I agree with your view.
It is highly recommended you commit the generated package lock to source control: this will allow anyone else on your team, your deployments, your CI/continuous integration, and anyone else who runs npm install in your package source to get the exact same dependency tree that you were developing on.
@KristjanESPERANTO Personally I always add it to .gitignore
along with node_modules
folder.