`npm install` doesn't respect the individual lib's package-lock.json. The end user project's lockfile wins out.
So you can be developing locally just fine, but when you `npm publish` everything breaks because an upstream lib published a release with a bug.