Package-lock.json pins only first-order dependencies (twitter.com)

Doesn't using `npm ci` instead of `npm install` keep transitive dependencies pinned as well?