from npm documentation:
By default, the following paths and files are ignored, so there’s no need to add them to .npmignore explicitly:
.*.swp ._* .DS_Store .git .hg .npmrc .lock-wscript .svn .wafpickle-* config.gypi CVS npm-debug.logAdditionally, everything in node_modules is ignored, except for bundled dependencies. npm automatically handles this for you, so don’t bother adding node_modules to .npmignore.
when npm pack is executed, package-lock.json is not included in the archive.
is it a bug or is it expected and undocumented behavior?