In #3745, @imsahil007 added support for npm package-lock.json files, but since he added support for the type of file I'd been using for an invalid test, we need a new test for that:

2. We probably should still have some sort of invalid file test. Obviously the npm one we had won't work and you were correct to remove it, but maybe test it against something else that will show up as malformed?

Originally posted by @terriko in #3745 (review)

This is probably a beginner-friendly issue.