package-lock.json, the lockfile. package.json allows ^2.4.0, so any compatible version is permitted. npm ci installs exactly what the committed lockfile says (2.4.3). npm install will also honor the lockfile if it's present, but if the local lockfile was regenerated and not committed, or is missing entirely, npm resolves to the newest allowed version (2.5.0). The drift means CI and local are reading different lockfile states.