package-lock, package.json, woe

I'm not a node expert by any means. In one project, something's gone wrong somewhere, and package-lock.json and package.json seems to have fallen out of sync. The only way I can get stuff to build is this sequence:

rm -rf node-modules npm install rm package-lock.json npm install webpack

i.e. I have to run npm install once with package-lock, and then once without. There are a lot of dependencies, and tracking down which ones are needed is proving difficult. What's the best way of resolving this so that I don't need to npm install twice? And how can I prevent this sort of thing not arising in the future?

Note: Two different devs were working on this git repo, and it's very possible that the package-lock and package files were not checked in properly.

via ashic