How do I ensure I get the same npm packages?

So I have an application whose tests are not passing. The hypothesis is that the machine I cloned it to had a different version of node, so I changed the node/npm version to the one equal to the machine where the Mocha tests are passing. I assumed that would download the same exact packages as the original machine, but it doesn't, not even when I remove the caret on the package version numbers and not even if I do an rm -rf node_modules.

How do I ensure that I have the same exact packages? Including the packages that depend on the packages on package.json file.

The test that is failing is the following one:

the error is:  expected 400 to equal 201
      1) should create and get notes for a patient? /api/v2/patients/:patientId/notes


  27 passing (3s)
  1 pending
  1 failing

  1) Testing patients end points.
       given an user
         should create and get notes for a patient? /api/v2/patients/:patientId/notes:
     Error: Internal server error: expected 400 to equal 201
      at Object.<anonymous> (test/testutils/auth.utils.ts:226:11)
      at Generator.next (<anonymous>)
      at fulfilled (test/testutils/auth.utils.ts:5:58)
      at runMicrotasks (<anonymous>)
      at processTicksAndRejections (node:internal/process/task_queues:96:5)

Which is I believe, referring to this method:

export async function createPatientNote(
  tokenObjectDto: TokenObjectDto,
  patientPui: string,
  noteText: string,
  isPublic: boolean,
  noteType: NoteType,
  visibleAfter?: Date,
  title?: string
): Promise<ViewNoteDto> {
  
  const urlPath = p().api.v2.patients.$patientId.notes.$url.replace(':patientId', patientPui)
  
  const newNoteDto = new NewNoteDto(
    patientPui,
    noteType,
    noteText,
    !isPublic,
    visibleAfter,
    title,
    [
      new class implements ITag {
        key = 'Test';
        value = `createPatientNode for ${patientPui}`;
      }
    ]
  )
  
  const res = await request(app)
    .post(urlPath)
    .set('Authorization', 'Bearer ' + tokenObjectDto.token)
    .send(newNoteDto);
    
  expect(res.status).to.equal(StatusCodes.CREATED);
  
  const viewNoteDto = res.body
  
  expect(viewNoteDto.pui).equal(patientPui)
  
  return viewNoteDto
}

This is the package-lock.json file: https://gist.github.com/ldco2016/3bb682442b6d16976f8ffbd4ec53809d

It seems to throw an error before or on attempt to to execute the urlPath.