Stop panic-grepping your lockfile after an npm compromise alert

A line in package-lock.json means your dependency tree can resolve the bad version. It says nothing...