package.json should not be processed in package-lock.json is present

Currently both are processed (with package-lock taking precedence), but the contents of the lock should take precedence over the entire contents of package.json.