A line in package-lock. json means your dependency tree can resolve the bad version. It says nothing about whether a machine downloaded it, and even less about whether it ran.
Source: [Dev.to](https://dev.to/secbyjasonmiller/stop-panic-grepping-your-lockfile-after-an-npm-compromise-alert-4k00)