diff --git a/src/api/json/catalog.json b/src/api/json/catalog.json
index 5bdcab8cb4f..9e7cf972c2f 100644
--- a/src/api/json/catalog.json
+++ b/src/api/json/catalog.json
@@ -5555,6 +5555,21 @@
       "fileMatch": ["resolutions.yml", "resolutions.yaml"],
       "url": "https://raw.githubusercontent.com/oss-review-toolkit/ort/main/integrations/schemas/resolutions-schema.json"
     },
+    {
+      "name": "package-lock.json",
+      "description": "NPM package lockfile",
+      "fileMatch": [
+        "package-lock.json",
+        "npm-shrinkwrap.json",
+        ".package-lock.json"
+      ],
+      "url": "https://www.schemastore.org/package-lock-3.json",
+      "versions": {
+        "1": "https://www.schemastore.org/package-lock-1.json",
+        "2": "https://www.schemastore.org/package-lock-2.json",
+        "3": "https://www.schemastore.org/package-lock-3.json"
+      }
+    },
     {
       "name": "package.json",
       "description": "NPM configuration file",
diff --git a/src/schema-validation.jsonc b/src/schema-validation.jsonc
index d6ad3debf4d..57277ba685b 100644
--- a/src/schema-validation.jsonc
+++ b/src/schema-validation.jsonc
@@ -211,6 +211,9 @@
     "opensrm.json",
     "opspec-io-0.1.7.json",
     "package.json",
+    "package-lock-1.json",
+    "package-lock-2.json",
+    "package-lock-3.json",
     "package.manifest-8.0.0.json",
     "package.manifest.json",
     "paper-plugin.json",
@@ -438,6 +441,9 @@
     "cargo-lints-cargo.json",
     "cargo-lints-clippy.json",
     "cargo-lints-rust.json",
+    "package-lock-1.json",
+    "package-lock-2.json",
+    "package-lock-3.json",
     "partial-pyright.json", // pyproject.json[tool.pyright]
     "partial-setuptools.json", // pyproject.json[tool.setuptools]
     "partial-setuptools-scm.json", // pyproject.json[tool.setuptools-scm]
@@ -1343,6 +1349,60 @@
       "externalSchema": ["geojson.json"],
       "unknownKeywords": ["name"]
     },
+    "package-lock-1.json": {
+      "externalSchema": [
+        "package.json",
+        "eslintrc.json",
+        "partial-eslint-plugins.json",
+        "prettierrc.json",
+        "ava.json",
+        "npm-badges.json",
+        "stylelintrc.json",
+        "semantic-release.json",
+        "jscpd.json",
+        "nodemon.json",
+        "base.json",
+        "quikrun.json"
+      ],
+      "unknownKeywords": ["tsType"]
+    },
+    "package-lock-2.json": {
+      "externalSchema": [
+        "package.json",
+        "package-lock-1.json",
+        "eslintrc.json",
+        "partial-eslint-plugins.json",
+        "prettierrc.json",
+        "ava.json",
+        "npm-badges.json",
+        "stylelintrc.json",
+        "semantic-release.json",
+        "jscpd.json",
+        "nodemon.json",
+        "base.json",
+        "quikrun.json"
+      ],
+      "unknownKeywords": ["tsType"]
+    },
+    "package-lock-3.json": {
+      "externalSchema": [
+        "package.json",
+        "package-lock-1.json",
+        "package-lock-2.json",
+        "eslintrc.json",
+        "partial-eslint-plugins.json",
+        "prettierrc.json",
+        "ava.json",
+        "npm-badges.json",
+        "stylelintrc.json",
+        "semantic-release.json",
+        "jscpd.json",
+        "nodemon.json",
+        "base.json",
+        "quikrun.json"
+      ],
+      "unknownKeywords": ["tsType"]
+    },
     "package.json": {
       "externalSchema": [
         "eslintrc.json",
diff --git a/src/schemas/json/package-lock-1.json b/src/schemas/json/package-lock-1.json
new file mode 100644
index 00000000000..21509889fa1
--- /dev/null
+++ b/src/schemas/json/package-lock-1.json
@@ -0,0 +1,160 @@
+{
+  "$schema": "http://json-schema.org/draft-07/schema#",
+  "$id": "https://json.schemastore.org/package-lock-1.json",
+  "$comment": "Added in npm v5",
+  "additionalProperties": true,
+  "description": "DEPRECATED. NPM package lockfile, version 1",
+  "type": "object",
+  "definitions": {
+    "integrity": {
+      "type": "string",
+      "description": "A Standard Subresource Integrity (SRI) value for this resource."
+    },
+    "lockfileVersion": {
+      "$comment": "Any version below 3 is DEPRECATED.",
+      "type": "integer",
+      "description": "The version number of this document whose semantics were used when generating this lockfile.",
+      "minimum": 1,
+      "default": 3
+    },
+    "packageProperties": {
+      "properties": {
+        "deprecated": {
+          "description": "UNDOCUMENTED. A deprecation message. If present, indicates this package is deprecated.",
+          "type": "string"
+        },
+        "devDependencies": {
+          "$comment": "https://docs.npmjs.com/cli/v11/configuring-npm/package-json#devdependencies",
+          "$ref": "package.json#/properties/devDependencies",
+          "description": "UNDOCUMENTED. Specifies dependencies that are required for the development and testing of the project. These dependencies are not needed in the production environment."
+        },
+        "funding": {
+          "$comment": "Prior to npm v11, this field is UNDOCUMENTED. https://docs.npmjs.com/cli/v11/configuring-npm/package-json#funding",
+          "$ref": "package.json#/properties/funding",
+          "description": "Funding information for the package, as specified in `package.json`. This field contains details about how to support the package maintainers."
+        },
+        "peerDependencies": {
+          "$comment": "https://docs.npmjs.com/cli/v11/configuring-npm/package-json#peerdependencies",
+          "$ref": "package.json#/properties/peerDependencies",
+          "description": "UNDOCUMENTED. Specifies dependencies that are required by the package but are expected to be provided by the consumer of the package."
+        },
+        "os": {
+          "$comment": "Prior to npm v11, this field is UNDOCUMENTED. https://docs.npmjs.com/cli/v11/configuring-npm/package-json#os",
+          "$ref": "package.json#/properties/os",
+          "description": "An array of operating systems this package is compatible with, as specified in `package.json`. This field is included when the package specifies OS restrictions."
+        },
+        "cpu": {
+          "$comment": "Prior to npm v11, this field is UNDOCUMENTED. https://docs.npmjs.com/cli/v11/configuring-npm/package-json#cpu",
+          "$ref": "package.json#/properties/cpu",
+          "description": "An array of CPU architectures this package is compatible with, as specified in `package.json`. This field is included when the package specifies CPU restrictions."
+        }
+      }
+    }
+  },
+  "properties": {
+    "dependencies": {
+      "patternProperties": {
+        "^.*$": {
+          "$comment": "https://docs.npmjs.com/cli/v6/configuring-npm/package-lock-json#dependencies",
+          "$ref": "#/definitions/packageProperties",
+          "type": "object",
+          "additionalProperties": true,
+          "description": "A mapping of package locations to an object containing information about that package. npm v7 ignores this section entirely if a `packages` section is present, but does keep it up to date in order to support switching between npm v6 and npm v7.",
+          "properties": {
+            "dependencies": {
+              "$ref": "#/properties/dependencies",
+              "description": "The dependencies of this dependency, exactly as at the top level."
+            },
+            "bundled": {
+              "$comment": "https://docs.npmjs.com/cli/v6/configuring-npm/package-lock-json#bundled",
+              "description": "If `true`, this is the bundled dependency and will be installed by the parent module. When installing, this module will be extracted from the parent module during the extract phase, not installed as a separate dependency.",
+              "type": "boolean"
+            },
+            "bundledDependencies": {
+              "$comment": "https://docs.npmjs.com/cli/v11/configuring-npm/package-json#bundledependencies",
+              "$ref": "package.json#/properties/bundledDependencies",
+              "description": "UNDOCUMENTED. DEPRECATED: This field is honored, but \"bundleDependencies\" is the correct field name. Ignored if \"bundleDependencies\" is also present."
+            },
+            "bundleDependencies": {
+              "$comment": "https://docs.npmjs.com/cli/v11/configuring-npm/package-json#bundledependencies",
+              "$ref": "package.json#/properties/bundleDependencies",
+              "description": "UNDOCUMENTED. Array of package names that will be bundled when publishing the package."
+            },
+            "dev": {
+              "$comment": "https://docs.npmjs.com/cli/v6/configuring-npm/package-lock-json#dev",
+              "description": "If `true`, then this dependency is either a development dependency ONLY of the top level module or a transitive dependency of one. This is `false` for dependencies that are both a development dependency of the top level and a transitive dependency of a non-development dependency of the top level.",
+              "type": "boolean"
+            },
+            "optional": {
+              "$comment": "https://docs.npmjs.com/cli/v6/configuring-npm/package-lock-json#optional",
+              "description": "If `true`, then this dependency is either an optional dependency ONLY of the top level module or a transitive dependency of one. This is `false` for dependencies that are both an optional dependency of the top level and a transitive dependency of a non-optional dependency of the top level. All optional dependencies should be included even if they're uninstallable on the current platform.",
+              "type": "boolean"
+            },
+            "integrity": {
+              "$comment": "https://docs.npmjs.com/cli/v6/configuring-npm/package-lock-json#integrity",
+              "$ref": "#/definitions/integrity"
+            },
+            "peer": {
+              "$comment": "https://docs.npmjs.com/cli/v11/configuring-npm/package-lock-json#dependencies",
+              "description": "UNDOCUMENTED. A flag to indicate this package is a peer dependency.",
+              "type": "boolean"
+            },
+            "resolved": {
+              "$comment": "https://docs.npmjs.com/cli/v6/configuring-npm/package-lock-json#resolved",
+              "description": "For registry sources, this is path of the tarball relative to the registry URL. If the tarball URL isn't on the same server as the registry URL then this is a complete URL. For bundled dependencies, this is not included, regardless of source.",
+              "type": "string"
+            },
+            "requires": {
+              "$comment": "https://docs.npmjs.com/cli/v6/configuring-npm/package-lock-json#requires",
+              "description": "A mapping of module name to version. This is a list of everything this module requires, regardless of where it will be installed. The version should match, via normal matching rules, a dependency either in our `dependencies` or in a level higher than us.",
+              "type": "object",
+              "patternProperties": {
+                "^.+$": {
+                  "$comment": "https://docs.npmjs.com/cli/v6/configuring-npm/package-lock-json#requires",
+                  "type": "string",
+                  "description": "The version range for the dependency."
+                }
+              }
+            },
+            "version": {
+              "$comment": "https://docs.npmjs.com/cli/v6/configuring-npm/package-lock-json#version-1",
+              "$ref": "#/properties/version",
+              "description": "This is a specifier that uniquely identifies this package and should be usable in fetching a new copy of it."
+            }
+          }
+        }
+      }
+    },
+    "name": {
+      "$comment": "https://docs.npmjs.com/cli/v6/configuring-npm/package-lock-json#name",
+      "$ref": "package.json#/properties/name",
+      "description": "The name of the package this is a lockfile for. This must match what's in `package.json`."
+    },
+    "lockfileVersion": {
+      "$comment": "https://docs.npmjs.com/cli/v6/configuring-npm/package-lock-json#lockfileversion",
+      "$ref": "#/definitions/lockfileVersion",
+      "const": 1
+    },
+    "packageIntegrity": {
+      "$comment": "https://docs.npmjs.com/cli/v6/configuring-npm/package-lock-json#packageintegrity",
+      "$ref": "#/definitions/integrity",
+      "description": "DEPRECATED. This is an SRI created from the `package.json`. No preprocessing of the `package.json` should be done."
+    },
+    "preserveSymlinks": {
+      "$comment": "https://docs.npmjs.com/cli/v6/configuring-npm/package-lock-json#preservesymlinks",
+      "type": "string",
+      "description": "DEPRECATED. Indicates that the install was done with the environment variable `NODE_PRESERVE_SYMLINKS` set to this value. The installer should insist that the value of this property match that environment variable."
+    },
+    "requires": {
+      "type": "boolean",
+      "default": true,
+      "description": "UNDOCUMENTED."
+    },
+    "version": {
+      "$comment": "https://docs.npmjs.com/cli/v6/configuring-npm/package-lock-json#version",
+      "$ref": "package.json#/properties/version",
+      "description": "The version of the package this is a lockfile for. This must match what's in `package.json`."
+    }
+  },
+  "required": ["name", "version", "lockfileVersion"]
+}
diff --git a/src/schemas/json/package-lock-2.json b/src/schemas/json/package-lock-2.json
new file mode 100644
index 00000000000..c604d7af3c5
--- /dev/null
+++ b/src/schemas/json/package-lock-2.json
@@ -0,0 +1,155 @@
+{
+  "$schema": "http://json-schema.org/draft-07/schema#",
+  "$id": "https://json.schemastore.org/package-lock-2.json",
+  "$comment": "Added in npm v7",
+  "additionalProperties": true,
+  "description": "DEPRECATED. NPM package lockfile, version 2",
+  "type": "object",
+  "definitions": {
+    "link": {
+      "$comment": "https://docs.npmjs.com/cli/v11/configuring-npm/package-lock-json#packages",
+      "description": "A flag to indicate that this is a symbolic link. If this is present, no other fields are specified, since the link target will also be included in the lockfile.",
+      "type": "boolean"
+    },
+    "linkedPackage": {
+      "properties": {
+        "link": {
+          "$ref": "#/definitions/link",
+          "const": true
+        }
+      },
+      "required": ["link"]
+    },
+    "packageProperties": {
+      "$ref": "package-json-1.json/#/definitions/packageProperties",
+      "properties": {
+        "peerDependenciesMeta": {
+          "$comment": "https://docs.npmjs.com/cli/v11/configuring-npm/package-json#peerdependenciesmeta",
+          "$ref": "package.json#/properties/peerDependenciesMeta",
+          "description": "UNDOCUMENTED. When a user installs your package, warnings are emitted if packages specified in \"peerDependencies\" are not already installed. The \"peerDependenciesMeta\" field serves to provide more information on how your peer dependencies are utilized. Most commonly, it allows peer dependencies to be marked as optional. Metadata for this field is specified with a simple hash of the package name to a metadata object."
+        },
+        "workspaces": {
+          "$comment": "https://docs.npmjs.com/cli/v11/configuring-npm/package-json#workspaces",
+          "$ref": "package.json#/properties/workspaces",
+          "description": "UNDOCUMENTED. Allows packages within a directory to depend on one another using direct linking of local files. Additionally, dependencies within a workspace are hoisted to the workspace root when possible to reduce duplication. Note: It's also a good idea to set \"private\" to true when using this feature."
+        }
+      }
+    },
+    "unlinkedPackage": {
+      "properties": {
+        "bin": {
+          "$comment": "https://docs.npmjs.com/cli/v11/configuring-npm/package-json#bin",
+          "$ref": "package.json#/properties/bin",
+          "description": "Matches the `bin` field set in package.json"
+        },
+        "dependencies": {
+          "$comment": "https://docs.npmjs.com/cli/v11/configuring-npm/package-json#dependencies",
+          "$ref": "package.json#/properties/dependencies",
+          "description": "Matches the `dependencies` field set in package.json"
+        },
+        "dev": {
+          "description": "A flag specifying this package is strictly part of the `devDependencies` tree.",
+          "type": "boolean"
+        },
+        "devOptional": {
+          "description": "A flag specifying this package is a `dev` dependency *and* an `optional` dependency of a non-dev dependency.",
+          "type": "boolean"
+        },
+        "engines": {
+          "$comment": "https://docs.npmjs.com/cli/v11/configuring-npm/package-json#engines",
+          "$ref": "package.json#/properties/engines",
+          "description": "Matches the `engines` field set in package.json"
+        },
+        "hasInstallScript": {
+          "description": "A flag to indicate that this package has a `preinstall`, `install`, or `postinstall` script.",
+          "type": "boolean"
+        },
+        "hasShrinkwrap": {
+          "description": "A flag to indicate that this package has an `npm-shrinkwrap.json` file.",
+          "type": "boolean"
+        },
+        "inBundle": {
+          "description": "A flag to indicate that this package is a bundled dependency.",
+          "type": "boolean"
+        },
+        "integrity": {
+          "$ref": "package-lock-1.json#/definitions/integrity",
+          "description": "A `sha512` or `sha1` SRI for the artifact that was unpacked in this location. For git dependencies, this is the commit hash."
+        },
+        "license": {
+          "$comment": "https://docs.npmjs.com/cli/v11/configuring-npm/package-json#license",
+          "$ref": "package.json#/properties/license",
+          "description": "Matches the `license` field set in package.json"
+        },
+        "link": {
+          "$ref": "#/definitions/link",
+          "const": false
+        },
+        "optional": {
+          "$comment": "https://docs.npmjs.com/cli/v11/configuring-npm/package-lock-json#packages",
+          "description": "A flag to indicate this this package is either an `optional` dependency of a `dev` dependency, or strictly part of the `optionalDependencies` tree and not a `dev` dependency.",
+          "type": "boolean"
+        },
+        "optionalDependencies": {
+          "$comment": "https://docs.npmjs.com/cli/v11/configuring-npm/package-json#optionaldependencies",
+          "$ref": "package.json#/properties/optionalDependencies",
+          "description": "Matches the `optionalDependencies` field set in `package.json`"
+        },
+        "resolved": {
+          "$comment": "https://docs.npmjs.com/cli/v11/configuring-npm/package-lock-json#packages",
+          "description": "For registry sources, this is path of the tarball relative to the registry URL. If the tarball URL isn't on the same server as the registry URL then this is a complete URL. For bundled dependencies, this is not included, regardless of source.",
+          "type": "string"
+        },
+        "version": {
+          "$comment": "https://docs.npmjs.com/cli/v11/configuring-npm/package-lock-json#packages",
+          "$ref": "#/properties/version",
+          "description": "The version found in `package.json`"
+        }
+      },
+      "required": ["version"]
+    }
+  },
+  "properties": {
+    "dependencies": {
+      "$comment": "https://docs.npmjs.com/cli/v11/configuring-npm/package-lock-json#dependencies",
+      "$ref": "package-lock-1.json#/properties/dependencies"
+    },
+    "name": {
+      "$comment": "https://docs.npmjs.com/cli/v11/configuring-npm/package-lock-json#name",
+      "$ref": "package-lock-1.json#/properties/name"
+    },
+    "lockfileVersion": {
+      "$comment": "https://docs.npmjs.com/cli/v8/configuring-npm/package-lock-json#lockfileversion",
+      "$ref": "package-lock-1.json#/definitions/lockfileVersion",
+      "const": 2
+    },
+    "packages": {
+      "$comment": "https://docs.npmjs.com/cli/v11/configuring-npm/package-lock-json#packages",
+      "type": "object",
+      "additionalProperties": true,
+      "description": "A mapping of package locations to an object containing information about that package. The root project is typically listed with a key of `\"\"`, and all other packages are listed with their relative paths from the root project folder.",
+      "patternProperties": {
+        "^.*$": {
+          "$comment": "https://docs.npmjs.com/cli/v11/configuring-npm/package-lock-json#packages",
+          "oneOf": [
+            {
+              "$ref": "#/definitions/unlinkedPackage"
+            },
+            {
+              "$ref": "#/definitions/linkedPackage"
+            }
+          ]
+        }
+      }
+    },
+    "requires": {
+      "$comment": "https://docs.npmjs.com/cli/v11/configuring-npm/package-lock-json#dependencies",
+      "$ref": "package-lock-1.json#/properties/requires"
+    },
+    "version": {
+      "$comment": "https://docs.npmjs.com/cli/v11/configuring-npm/package-lock-json#dependencies",
+      "$ref": "package-lock-1.json#/properties/version"
+    }
+  },
+  "required": ["name", "version", "lockfileVersion"]
+}
diff --git a/src/schemas/json/package-lock-3.json b/src/schemas/json/package-lock-3.json
new file mode 100644
index 00000000000..db4803bcf64
--- /dev/null
+++ b/src/schemas/json/package-lock-3.json
@@ -0,0 +1,28 @@
+{
+  "$schema": "http://json-schema.org/draft-07/schema#",
+  "$id": "https://json.schemastore.org/package-lock-3.json",
+  "$comment": "Added in npm v7",
+  "additionalProperties": true,
+  "description": "NPM package lockfile, version 3",
+  "type": "object",
+  "properties": {
+    "name": {
+      "$ref": "package-lock-2.json#/properties/name"
+    },
+    "lockfileVersion": {
+      "$comment": "https://docs.npmjs.com/cli/v11/configuring-npm/package-lock-json#lockfileversion",
+      "$ref": "package-lock-1.json#/definitions/lockfileVersion",
+      "const": 3
+    },
+    "packages": {
+      "$ref": "package-lock-2.json#/properties/packages"
+    },
+    "requires": {
+      "$ref": "package-lock-2.json#/properties/requires"
+    },
+    "version": {
+      "$ref": "package-lock-2.json#/properties/version"
+    }
+  },
+  "required": ["name", "version", "lockfileVersion"]
+}
diff --git a/src/schemas/json/package.json b/src/schemas/json/package.json
index e3e176c3984..fa1b99349b0 100644
--- a/src/schemas/json/package.json
+++ b/src/schemas/json/package.json
@@ -4,26 +4,30 @@
   "definitions": {
     "person": {
       "description": "A person who has been involved in creating or maintaining this package.",
-      "type": [
-        "object",
-        "string"
-      ],
-      "required": [
-        "name"
-      ],
-      "properties": {
-        "name": {
-          "type": "string"
-        },
-        "url": {
-          "type": "string",
-          "format": "uri"
+      "oneOf": [
+        {
+          "type": "object",
+          "required": [
+            "name"
+          ],
+          "properties": {
+            "name": {
+              "type": "string"
+            },
+            "url": {
+              "type": "string",
+              "format": "uri"
+            },
+            "email": {
+              "type": "string",
+              "format": "email"
+            }
+          }
         },
-        "email": {
-          "type": "string",
-          "format": "email"
+        {
+          "type": "string"
         }
-      }
+      ]
     },
     "dependency": {
       "description": "Dependencies are specified with a simple hash of package name to version range. The version range is a string which has one or more space-separated descriptors. Dependencies can also be identified with a tarball or git URL.",
@@ -141,12 +145,16 @@
       "x-intellij-language-injection": "Shell Script"
     },
     "packageExportsEntryPath": {
-      "type": [
-        "string",
-        "null"
+      "oneOf": [
+        {
+          "type": "string",
+          "pattern": "^\\./"
+        },
+        {
+          "type": "null"
+        }
       ],
-      "description": "The module path that is resolved when this specifier is imported. Set to `null` to disallow importing this module.",
-      "pattern": "^\\./"
+      "description": "The module path that is resolved when this specifier is imported. Set to `null` to disallow importing this module."
     },
     "packageExportsEntryObject": {
       "type": "object",
@@ -179,7 +187,7 @@
         }
       },
       "patternProperties": {
-        "^[^.0-9]+$": {
+        "^(?!(?:require|import|module-sync|node|default|types)$)[^.0-9]+$": {
           "$ref": "#/definitions/packageExportsEntryOrFallback",
           "description": "The module path that is resolved when this environment matches the property name."
         },
@@ -218,9 +226,13 @@
       ]
     },
     "packageImportsEntryPath": {
-      "type": [
-        "string",
-        "null"
+      "oneOf": [
+        {
+          "type": "string"
+        },
+        {
+          "type": "null"
+        }
       ],
       "description": "The module path that is resolved when this specifier is imported. Set to `null` to disallow importing this module."
     },
@@ -250,7 +262,7 @@
         }
       },
       "patternProperties": {
-        "^[^.0-9]+$": {
+        "^(?!(?:require|import|node|default|types)$)[^.0-9]+$": {
           "$ref": "#/definitions/packageImportsEntryOrFallback",
           "description": "The module path that is resolved when this environment matches the property name."
         },
@@ -400,22 +412,26 @@
     },
     "bugs": {
       "description": "The url to your project's issue tracker and / or the email address to which issues should be reported. These are helpful for people who encounter issues with your package.",
-      "type": [
-        "object",
-        "string"
-      ],
-      "properties": {
-        "url": {
-          "type": "string",
-          "description": "The url to your project's issue tracker.",
-          "format": "uri"
+      "oneOf": [
+        {
+          "type": "object",
+          "properties": {
+            "url": {
+              "type": "string",
+              "description": "The url to your project's issue tracker.",
+              "format": "uri"
+            },
+            "email": {
+              "type": "string",
+              "description": "The email address to which issues should be reported.",
+              "format": "email"
+            }
+          }
         },
-        "email": {
-          "type": "string",
-          "description": "The email address to which issues should be reported.",
-          "format": "email"
+        {
+          "type": "string"
         }
-      }
+      ]
     },
     "license": {
       "$ref": "#/definitions/license",
@@ -510,13 +526,17 @@
       "additionalProperties": false
     },
     "bin": {
-      "type": [
-        "string",
-        "object"
-      ],
-      "additionalProperties": {
-        "type": "string"
-      }
+      "oneOf": [
+        {
+          "type": "string"
+        },
+        {
+          "type": "object",
+          "additionalProperties": {
+            "type": "string"
+          }
+        }
+      ]
     },
     "type": {
       "description": "When set to \"module\", the type field allows a package to specify all .js files within are ES modules. If the \"type\" field is omitted or set to \"commonjs\", all .js files are treated as CommonJS.",
@@ -559,7 +579,7 @@
               "type": "string"
             }
           },
-          "^[^*]*\\*[^*]*$": {
+          "^(?!\\*$)[^*]*\\*[^*]*$": {
             "description": "Maps file paths matching the pattern specified in property key to file paths specified in the array.",
             "type": "array",
             "items": {
@@ -572,14 +592,18 @@
       }
     },
     "man": {
-      "type": [
-        "array",
-        "string"
+      "oneOf": [
+        {
+          "type": "array",
+          "items": {
+            "type": "string"
+          }
+        },
+        {
+          "type": "string"
+        }
       ],
-      "description": "Specify either a single file or an array of filenames to put in place for the man program to find.",
-      "items": {
-        "type": "string"
-      }
+      "description": "Specify either a single file or an array of filenames to put in place for the man program to find."
     },
     "directories": {
       "type": "object",
@@ -611,21 +635,25 @@
     },
     "repository": {
       "description": "Specify the place where your code lives. This is helpful for people who want to contribute.",
-      "type": [
-        "object",
-        "string"
-      ],
-      "properties": {
-        "type": {
-          "type": "string"
-        },
-        "url": {
-          "type": "string"
+      "oneOf": [
+        {
+          "type": "object",
+          "properties": {
+            "type": {
+              "type": "string"
+            },
+            "url": {
+              "type": "string"
+            },
+            "directory": {
+              "type": "string"
+            }
+          }
         },
-        "directory": {
+        {
           "type": "string"
         }
-      }
+      ]
     },
     "funding": {
       "oneOf": [
@@ -873,6 +901,8 @@
       }
     },
     "engineStrict": {
+      "$comment": "Removed in npm v3",
+      "description": "DEPRECATED. A flag that indicates this package should be treated as if the user had set `engine-strict`.",
       "type": "boolean"
     },
     "os": {
@@ -966,6 +996,7 @@
       }
     },
     "preferGlobal": {
+      "$comment": "Removed in npm v7",
       "type": "boolean",
       "description": "DEPRECATED: This option used to trigger an npm warning, but it will no longer warn. It is purely there for informational purposes. It is now recommended that you install any binaries as local devDependencies wherever possible."
     },
@@ -1026,21 +1057,25 @@
     },
     "esnext": {
       "description": "A module ID with untranspiled code that is the primary entry point to your program.",
-      "type": [
-        "string",
-        "object"
-      ],
-      "properties": {
-        "main": {
+      "oneOf": [
+        {
           "type": "string"
         },
-        "browser": {
-          "type": "string"
+        {
+          "type": "object",
+          "properties": {
+            "main": {
+              "type": "string"
+            },
+            "browser": {
+              "type": "string"
+            }
+          },
+          "additionalProperties": {
+            "type": "string"
+          }
         }
-      },
-      "additionalProperties": {
-        "type": "string"
-      }
+      ]
     },
     "workspaces": {
       "description": "Allows packages within a directory to depend on one another using direct linking of local files. Additionally, dependencies within a workspace are hoisted to the workspace root when possible to reduce duplication. Note: It's also a good idea to set \"private\" to true when using this feature.",
@@ -1299,9 +1334,13 @@
         },
         "startCommand": {
           "description": "A terminal command to be executed when opening the project, after installing npm dependencies.",
-          "type": [
-            "string",
-            "boolean"
+          "oneOf": [
+            {
+              "type": "string"
+            },
+            {
+              "type": "boolean"
+            }
           ]
         },
         "compileTrigger": {
diff --git a/src/test/package-lock-1/dependencies.json b/src/test/package-lock-1/dependencies.json
new file mode 100644
index 00000000000..bd1d4f7cfd3
--- /dev/null
+++ b/src/test/package-lock-1/dependencies.json
@@ -0,0 +1,6 @@
+{
+  "dependencies": {},
+  "lockfileVersion": 1,
+  "name": "a",
+  "version": "0.0.0"
+}
diff --git a/src/test/package-lock-1/dependencyIntegrity.json b/src/test/package-lock-1/dependencyIntegrity.json
new file mode 100644
index 00000000000..86086769443
--- /dev/null
+++ b/src/test/package-lock-1/dependencyIntegrity.json
@@ -0,0 +1,11 @@
+{
+  "dependencies": {
+    "hoek": {
+      "integrity": "sha512-v0XCLxICi9nPfYrS9RL8HbYnXi9obYAeLbSP00BmnZwCK9+Ih9WOjoZ8YoHCoav2csqn4FOz4Orldsy2dmDwmQ==",
+      "version": "4.2.0"
+    }
+  },
+  "lockfileVersion": 1,
+  "name": "a",
+  "version": "0.0.0"
+}
diff --git a/src/test/package-lock-1/dependencyVersion.json b/src/test/package-lock-1/dependencyVersion.json
new file mode 100644
index 00000000000..fac28865361
--- /dev/null
+++ b/src/test/package-lock-1/dependencyVersion.json
@@ -0,0 +1,10 @@
+{
+  "dependencies": {
+    "@types/test": {
+      "version": "1.2.3"
+    }
+  },
+  "lockfileVersion": 1,
+  "name": "a",
+  "version": "0.0.0"
+}
diff --git a/src/test/package-lock-1/general.json b/src/test/package-lock-1/general.json
new file mode 100644
index 00000000000..fc7208ee60c
--- /dev/null
+++ b/src/test/package-lock-1/general.json
@@ -0,0 +1,63 @@
+{
+  "dependencies": {
+    "body-parser": {
+      "dependencies": {
+        "iconv-lite": {
+          "dev": true,
+          "integrity": "sha1-H4irpKsLFQjoMSrMOTRfNumS4vI=",
+          "resolved": "https://registry.npmjs.org/iconv-lite/-/iconv-lite-0.4.13.tgz",
+          "version": "0.4.13"
+        },
+        "qs": {
+          "dev": true,
+          "integrity": "sha1-qfMRQq9GjLcrJbMBNrokVoNJFr4=",
+          "resolved": "https://registry.npmjs.org/qs/-/qs-5.2.0.tgz",
+          "version": "5.2.0"
+        }
+      },
+      "dev": true,
+      "integrity": "sha1-EBXLH+LEQ4WCWVgdtTMy+NDPUPk=",
+      "requires": {
+        "bytes": "2.2.0",
+        "content-type": "~1.0.1",
+        "debug": "~2.2.0",
+        "depd": "~1.1.0",
+        "http-errors": "~1.3.1",
+        "iconv-lite": "0.4.13",
+        "on-finished": "~2.3.0",
+        "qs": "5.2.0",
+        "raw-body": "~2.1.5",
+        "type-is": "~1.6.10"
+      },
+      "resolved": "https://registry.npmjs.org/body-parser/-/body-parser-1.14.2.tgz",
+      "version": "1.14.2"
+    },
+    "boom": {
+      "dependencies": {
+        "body-parser": {
+          "link": true
+        },
+        "hoek": {
+          "dev": true,
+          "integrity": "sha512-v0XCLxICi9nPfYrS9RL8HbYnXi9obYAeLbSP00BmnZwCK9+Ih9WOjoZ8YoHCoav2csqn4FOz4Orldsy2dmDwmQ==",
+          "optional": true,
+          "resolved": "https://registry.npmjs.org/hoek/-/hoek-4.2.0.tgz",
+          "version": "4.2.0"
+        }
+      },
+      "dev": true,
+      "integrity": "sha1-DwzF0ErcUAO4x9cfQsynJx/vDng=",
+      "optional": true,
+      "requires": {
+        "hoek": "4.x.x"
+      },
+      "resolved": "https://registry.npmjs.org/boom/-/boom-3.2.2.tgz",
+      "version": "3.2.2"
+    }
+  },
+  "lockfileVersion": 1,
+  "name": "project",
+  "preserveSymlinks": "abcdef",
+  "requires": true,
+  "version": "1.0.0"
+}
diff --git a/src/test/package-lock-1/min.json b/src/test/package-lock-1/min.json
new file mode 100644
index 00000000000..72461e16ab2
--- /dev/null
+++ b/src/test/package-lock-1/min.json
@@ -0,0 +1,5 @@
+{
+  "lockfileVersion": 1,
+  "name": "a",
+  "version": "0.0.0"
+}
diff --git a/src/test/package-lock-1/name.json b/src/test/package-lock-1/name.json
new file mode 100644
index 00000000000..97e46bc0b72
--- /dev/null
+++ b/src/test/package-lock-1/name.json
@@ -0,0 +1,5 @@
+{
+  "lockfileVersion": 1,
+  "name": "@is-(unknown)/is-one",
+  "version": "0.0.0"
+}
diff --git a/src/test/package-lock-1/packageIntegrity.json b/src/test/package-lock-1/packageIntegrity.json
new file mode 100644
index 00000000000..ba794eb58e4
--- /dev/null
+++ b/src/test/package-lock-1/packageIntegrity.json
@@ -0,0 +1,6 @@
+{
+  "lockfileVersion": 1,
+  "name": "test",
+  "packageIntegrity": "sha512-Q2bFTOhEALkN8hOms2FKTDLy7eugP2zFZ1T8LCvX42Fp3WoNr3bjZSAHeOsHrbV1Fu9/A0EzCinRE7Af1ofPrw==",
+  "version": "1.0.0"
+}
diff --git a/src/test/package-lock-1/preserveSymlinks.json b/src/test/package-lock-1/preserveSymlinks.json
new file mode 100644
index 00000000000..c5dcf3792c5
--- /dev/null
+++ b/src/test/package-lock-1/preserveSymlinks.json
@@ -0,0 +1,6 @@
+{
+  "lockfileVersion": 1,
+  "name": "test",
+  "preserveSymlinks": "abcd",
+  "version": "1.0.0"
+}
diff --git a/src/test/package-lock-1/requires.json b/src/test/package-lock-1/requires.json
new file mode 100644
index 00000000000..dc71cdc8eba
--- /dev/null
+++ b/src/test/package-lock-1/requires.json
@@ -0,0 +1,6 @@
+{
+  "lockfileVersion": 1,
+  "name": "a",
+  "requires": true,
+  "version": "0.0.0"
+}
diff --git a/src/test/package-lock-1/version.json b/src/test/package-lock-1/version.json
new file mode 100644
index 00000000000..7c1ae7599e0
--- /dev/null
+++ b/src/test/package-lock-1/version.json
@@ -0,0 +1,5 @@
+{
+  "lockfileVersion": 1,
+  "name": "a",
+  "version": "2.1.0-beta.6"
+}
diff --git a/src/test/package-lock-2/dependencies.json b/src/test/package-lock-2/dependencies.json
new file mode 100644
index 00000000000..e3b5aff5904
--- /dev/null
+++ b/src/test/package-lock-2/dependencies.json
@@ -0,0 +1,6 @@
+{
+  "dependencies": {},
+  "lockfileVersion": 2,
+  "name": "test",
+  "version": "0.0.0"
+}
diff --git a/src/test/package-lock-2/general.json b/src/test/package-lock-2/general.json
new file mode 100644
index 00000000000..8def5976781
--- /dev/null
+++ b/src/test/package-lock-2/general.json
@@ -0,0 +1,98 @@
+{
+  "dependencies": {
+    "body-parser": {
+      "dependencies": {
+        "iconv-lite": {
+          "dev": true,
+          "integrity": "sha1-H4irpKsLFQjoMSrMOTRfNumS4vI=",
+          "resolved": "https://registry.npmjs.org/iconv-lite/-/iconv-lite-0.4.13.tgz",
+          "version": "0.4.13"
+        },
+        "qs": {
+          "dev": true,
+          "funding": {
+            "type": "github",
+            "url": "https://github.com/sponsors/Vessel9817"
+          },
+          "integrity": "sha1-qfMRQq9GjLcrJbMBNrokVoNJFr4=",
+          "resolved": "https://registry.npmjs.org/qs/-/qs-5.2.0.tgz",
+          "version": "5.2.0"
+        }
+      },
+      "dev": true,
+      "integrity": "sha1-EBXLH+LEQ4WCWVgdtTMy+NDPUPk=",
+      "requires": {
+        "bytes": "2.2.0",
+        "content-type": "~1.0.1",
+        "debug": "~2.2.0",
+        "depd": "~1.1.0",
+        "http-errors": "~1.3.1",
+        "iconv-lite": "0.4.13",
+        "on-finished": "~2.3.0",
+        "qs": "5.2.0",
+        "raw-body": "~2.1.5",
+        "type-is": "~1.6.10"
+      },
+      "resolved": "https://registry.npmjs.org/body-parser/-/body-parser-1.14.2.tgz",
+      "version": "1.14.2"
+    },
+    "boom": {
+      "dependencies": {
+        "hoek": {
+          "dev": true,
+          "integrity": "sha512-v0XCLxICi9nPfYrS9RL8HbYnXi9obYAeLbSP00BmnZwCK9+Ih9WOjoZ8YoHCoav2csqn4FOz4Orldsy2dmDwmQ==",
+          "optional": true,
+          "resolved": "https://registry.npmjs.org/hoek/-/hoek-4.2.0.tgz",
+          "version": "4.2.0"
+        }
+      },
+      "dev": true,
+      "integrity": "sha1-DwzF0ErcUAO4x9cfQsynJx/vDng=",
+      "optional": true,
+      "requires": {
+        "hoek": "4.x.x"
+      },
+      "resolved": "https://registry.npmjs.org/boom/-/boom-3.2.2.tgz",
+      "version": "3.2.2"
+    }
+  },
+  "lockfileVersion": 2,
+  "name": "project",
+  "packages": {
+    "node_modules/@babel/helper-validator-identifier": {
+      "dev": true,
+      "engines": {
+        "node": ">=6.9.0"
+      },
+      "integrity": "sha512-K4JvCtQqad9OY2+yTU8w+E82ywk/fe+ELNlt1G8z3bVGlZfn/hOcQQsUhGhW/N+tb3fxK800wLtKOE/aM0m72w==",
+      "resolved": "https://registry.npmjs.org/@babel/helper-validator-identifier/-/helper-validator-identifier-7.15.7.tgz",
+      "version": "7.15.7"
+    },
+    "node_modules/ajv-draft-04": {
+      "dev": true,
+      "integrity": "sha512-svCd36YT75yU7ofob2z7ItEWo7kq4XicQYU9T7yiVaetWzaA4xz9kKsgq3py8v1ri0UQvoJ63YEqpDQ1W/DUww==",
+      "peerDependencies": {
+        "ajv": "^8.0.0"
+      },
+      "peerDependenciesMeta": {
+        "ajv": {
+          "optional": true
+        }
+      },
+      "resolved": "https://registry.npmjs.org/ajv-draft-04/-/ajv-draft-04-0.1.0.tgz",
+      "version": "0.1.0"
+    },
+    "": {
+      "devDependencies": {
+        "ajv": "^8.7.1",
+        "ajv-draft-04": "^0.1.0"
+      },
+      "license": "Apache 2.0",
+      "name": "@npm/apple",
+      "version": "1.0.0"
+    }
+  },
+  "preserveSymlinks": "abcdef",
+  "requires": true,
+  "version": "1.0.0"
+}
diff --git a/src/test/package-lock-2/min.json b/src/test/package-lock-2/min.json
new file mode 100644
index 00000000000..2708f4b4450
--- /dev/null
+++ b/src/test/package-lock-2/min.json
@@ -0,0 +1,5 @@
+{
+  "lockfileVersion": 2,
+  "name": "test",
+  "version": "0.0.0"
+}
diff --git a/src/test/package-lock-2/packageIntegrity.json b/src/test/package-lock-2/packageIntegrity.json
new file mode 100644
index 00000000000..a66a4847e2a
--- /dev/null
+++ b/src/test/package-lock-2/packageIntegrity.json
@@ -0,0 +1,7 @@
+{
+  "dependencies": {},
+  "lockfileVersion": 2,
+  "name": "test",
+  "packageIntegrity": "sha512-Q2bFTOhEALkN8hOms2FKTDLy7eugP2zFZ1T8LCvX42Fp3WoNr3bjZSAHeOsHrbV1Fu9/A0EzCinRE7Af1ofPrw==",
+  "version": "1.0.0"
+}
diff --git a/src/test/package-lock-2/packages.json b/src/test/package-lock-2/packages.json
new file mode 100644
index 00000000000..f2526225583
--- /dev/null
+++ b/src/test/package-lock-2/packages.json
@@ -0,0 +1,7 @@
+{
+  "dependencies": {},
+  "lockfileVersion": 2,
+  "name": "test",
+  "packages": {},
+  "version": "0.0.0"
+}
diff --git a/src/test/package-lock-2/preserveSymlinks.json b/src/test/package-lock-2/preserveSymlinks.json
new file mode 100644
index 00000000000..f5cf0e51cb0
--- /dev/null
+++ b/src/test/package-lock-2/preserveSymlinks.json
@@ -0,0 +1,7 @@
+{
+  "dependencies": {},
+  "lockfileVersion": 2,
+  "name": "test",
+  "preserveSymlinks": "abcd",
+  "version": "1.0.0"
+}
diff --git a/src/test/package-lock-2/requires.json b/src/test/package-lock-2/requires.json
new file mode 100644
index 00000000000..c2f7e9a92aa
--- /dev/null
+++ b/src/test/package-lock-2/requires.json
@@ -0,0 +1,7 @@
+{
+  "lockfileVersion": 2,
+  "name": "test",
+  "packages": {},
+  "requires": true,
+  "version": "0.0.0"
+}
diff --git a/src/test/package-lock-3/general.json b/src/test/package-lock-3/general.json
new file mode 100644
index 00000000000..f628bcdc7af
--- /dev/null
+++ b/src/test/package-lock-3/general.json
@@ -0,0 +1,29 @@
+{
+  "lockfileVersion": 3,
+  "name": "test",
+  "packages": {
+    "node_modules/@discoveryjs/json-ext": {
+      "dev": true,
+      "engines": {
+        "node": ">=14.17.0"
+      },
+      "integrity": "sha512-Xc3VhU02wqZ1HvHRJUwL09HkZSTvidqY5Ya0NXBSYOxAp+Ln9dcJr9fySI+CkONzP3PekQo9WdzCv0PGER/mOA==",
+      "license": "MIT",
+      "resolved": "https://registry.npmjs.org/@discoveryjs/json-ext/-/json-ext-1.1.0.tgz",
+      "version": "1.1.0"
+    },
+    "": {
+      "devDependencies": {
+        "@dotenvx/dotenvx": "^1.69.1"
+      },
+      "license": "MIT",
+      "name": "test",
+      "version": "0.0.0",
+      "workspaces": {
+        "packages": ["./src/package1"]
+      }
+    }
+  },
+  "requires": true,
+  "version": "0.0.0"
+}
diff --git a/src/test/package-lock-3/min.json b/src/test/package-lock-3/min.json
new file mode 100644
index 00000000000..d1f07baba15
--- /dev/null
+++ b/src/test/package-lock-3/min.json
@@ -0,0 +1,5 @@
+{
+  "lockfileVersion": 3,
+  "name": "test",
+  "version": "0.0.0"
+}
diff --git a/src/test/package-lock-3/packages.json b/src/test/package-lock-3/packages.json
new file mode 100644
index 00000000000..e73e8ee5b25
--- /dev/null
+++ b/src/test/package-lock-3/packages.json
@@ -0,0 +1,6 @@
+{
+  "lockfileVersion": 3,
+  "name": "test",
+  "packages": {},
+  "version": "0.0.0"
+}
diff --git a/src/test/package-lock-3/requires.json b/src/test/package-lock-3/requires.json
new file mode 100644
index 00000000000..ee4512a7054
--- /dev/null
+++ b/src/test/package-lock-3/requires.json
@@ -0,0 +1,7 @@
+{
+  "lockfileVersion": 3,
+  "name": "test",
+  "packages": {},
+  "requires": true,
+  "version": "0.0.0"
+}