Your package.json usually says things like "any version compatible with 4.17". Without a lockfile, two installs a week apart can pull different code. The lockfile pins the exact versions, including the dependencies of your dependencies, and usually a checksum for each.
That matters for security. If a package is hijacked and a bad version is published, an install without a lockfile may fetch it silently. With a committed lockfile and a strict install command, your build uses the versions you already reviewed, and any change shows up as a visible diff in code review.
AI tools and beginners often leave the lockfile out of git, delete it to fix an error, or run a command that rewrites it without anyone looking. Commit it, and use the strict install command in CI and on your servers, which fails if the lockfile and package.json disagree. When a lockfile changes, read the diff: unexpected new packages or changed sources deserve a question before you merge.
npm ci