package.json: Contains project metadata, dependencies, and scripts

{
  "name": "my-app",
  "version": "1.0.0",
  "dependencies": {
    "express": "^4.18.0"
  },
  "devDependencies": {
    "nodemon": "^2.0.15"
  }
}

package-lock.json: Locks exact versions of dependencies and their sub-dependencies for reproducible builds

• Ensures consistent installs across environments
• Contains integrity hashes for security
• Maps exact dependency tree structure
• Should be committed to version control