.env package-lock.json coverage