How do I fix a vulnerable npm package in my package-lock.json that isn't listed in the package.