I wanted to create a site with acknowledgments/attributions for all the packages used in my project (that's even required for the MIT licenses). So I thought about using
package.json for that purpose. But as I saw
package-lock.json I started doubting which licenses I have to credit?
Packagecontains all directly used files
Package-lockalso contains the dependencies of these files.