Better handling of when there's no package-lock.json

[ehs5]

Should consider if we want to show changes from package.json to package-lock.json and clearly state that that is what we are doing.
That way you can clone a repo, do wtpack, and see what differs from the last git commit.